mysqllog | Lightweight MySQL slow query log parser in Go

Take a look at the following regex:

(\d{4}-\d{2}-\d{2})\s*(\d{2}:\d{2}:\d{2})\s*(\d{4})\s*(.*)

Whole explanation can be seen in the regex demo below, but basically what it does is it looks for:

• a date (1st pair of ())
  • first 4 digits (\d{4}) for a year, followed by -
  • two digits for month (\d{2}) followed by another dash
  • another two digits for day (\d{2})
• a set of 0 or more spaces
• time (second pair of (), same logic as with date, just separated with colons (:)
• a set of 0 or more spaces
• another 4 digits (\d{4}) for code (if it can have any different number you can either skip curly braces and add a + instead, for a \d+ - this will ask for one or more digits)
• a set of 0 or more spaces
• anything that is left out (so it will be a description)

MySQL logs Regex demo

If I guessed the output of the Ubuntu logs correctly, it's more or less the same as MySQL logs, so I will not post full explanation - you can always check it on Regex101 demo below.

The Regex is as follows:
(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(?:\.\d+Z)\s*(\d+)\s*(.*)

Some notes about it:

• main change is that it separates date and time differently, hence the T in this regex
• it also stores miliseconds (?) after seconds using .##### format - I discard this information in substitution (if you need it, let me know)
• the rest is basically the same

Ubuntu logs Regex demo

Here is an updated Ubuntu demo that stores miliseconds as well and doesn't treat the 5 as code but a part of description: Link to demo

You can try the below aggregation.

Aggregation Stages - $match - $group - $project