json 对象原始数据字段到 php 数组

Question

我有一个从 splunk 中提取的 JSON 对象数据，其中一个字段 _raw 包含一串数据，但由于它的值不是有效的 json 字符串，我可以'似乎无法使用 json_decode()

将其转换为 php 数组

有什么想法可以将 _raw 的值转换为 php 数组吗？

这是我的json数据

{
    "result": {
        "_raw": "Jun 30 06:51:04 blablabla.com apache2: event_id="something" event="something" app="testapp" serial_number="066f1cda" revoke_reason="key compromise" revoke_comment="xxxxxx" delay_revoke="15" url="/blablabla.php" account_id="123456" user_id="xxxxxxx" staff_id="xxxx" staff_name="todd" ip_address="123.123.123.123"",
        "splunk_server": "splunkin02.localhost.com"
    },
    "results_link": "https://splunk.sffew.com",
    "app": "search",
    "search_name": "TEST",
    "owner": "toodles@sfsfe.com",
    "sid": "scheduler_blahlahlah"
}

希望能够引用字符串中的每个值，就像这样

Array (
     [event_id] => something
     [event] => something
     [app] => testapp
     [serial_number] => 066f1cda
     [revoke_reason] => key compromise
     [revoke_comment] => xxxxxx
     [delay_revoke] => 15
     [url] => /blablabla.php
     [account_id] => 123456
     [user_id] => xxxxxxx
     [staff_id] => xxxx
     [staff_name] => todd
     [ip_address] => 123.123.123.123
)

Answer 1

一种方法 preg_match_all() 和 foreach(),

<?php
$re = '/"_raw": (.*)(?=,)/m';
$str = '{
    "result": {
        "_raw": "Jun 30 06:51:04 blablabla.com apache2: event_id="something" event="something" app="testapp" serial_number="066f1cda" revoke_reason="key compromise" revoke_comment="xxxxxx" delay_revoke="15" url="/blablabla.php" account_id="123456" user_id="xxxxxxx" staff_id="xxxx" staff_name="todd" ip_address="123.123.123.123"",
        "splunk_server": "splunkin02.localhost.com"
    },
    "results_link": "https://splunk.sffew.com",
    "app": "search",
    "search_name": "TEST",
    "owner": "toodles@sfsfe.com",
    "sid": "scheduler_blahlahlah"
}';

preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
$parsable_array = explode(' ',$matches[0][1]);
$expected_array = array_filter($parsable_array, function ($var) { return (stripos($var, '=') != false); });
$final_result = [];
foreach($expected_array as $str){
    list($key,$value) = explode('=',$str);
    $final_result[$key] = trim($value,'"');
}
print_r($final_result);
?>

工作演示： https://3v4l.org/fFQSZ

Answer 2

您可以使用 preg_match_all() 像这样在 apache2: 之后找到所有 key="value" 对..

$raw = $json_decode($json)->result->_raw;

$marker = 'apache2: ';
$startAt = strpos($raw, $marker) + strlen($marker);

preg_match_all('/(\w+)="(.*?)"/', $raw, $matches, PREG_PATTERN_ORDER, $startAt);

$result = array_combine($matches[1], $matches[2]);

演示 ~ https://3v4l.org/idlRs

json 对象原始数据字段到 php 数组

json object raw data field into php array

php

json

splunk