Step 2: Parse the lines with a regular expression

A regular expression describes the shape of a line. Named groups (?P<name>...) give each part a name, so m.groupdict() returns a ready-made dictionary. Lines that do not match are kept aside with their line numbers instead of being silently thrown away, so you can see how much of the log you could not read.

Examplepython

import re

LOG = """2026-11-05 09:00:01 10.0.0.5 GET /home 200 120
2026-11-05 09:00:03 10.0.0.9 GET /login 200 80
2026-11-05 09:00:07 10.0.0.9 POST /login 401 95
2026-11-05 09:00:09 10.0.0.9 POST /login 401 91
2026-11-05 09:00:12 10.0.0.9 POST /login 401 99
2026-11-05 09:00:15 10.0.0.9 POST /login 401 97
2026-11-05 09:01:02 10.0.0.5 GET /courses 200 340
2026-11-05 09:01:20 10.0.0.7 GET /courses/python 200 410
2026-11-05 09:01:44 10.0.0.7 GET /missing 404 30
2026-11-05 09:02:05 10.0.0.5 GET /api/progress 500 1200
2026-11-05 09:02:09 10.0.0.5 GET /api/progress 500 1180
2026-11-05 09:02:30 10.0.0.8 GET /home 200 110
2026-11-05 09:03:10 10.0.0.8 GET /courses 200 360
2026-11-05 09:03:12 10.0.0.7 GET /home 200 105
2026-11-05 09:03:50 10.0.0.6 GET /api/progress 200 220
this line is not a valid log entry
2026-11-05 09:04:01 10.0.0.6 GET /home 200 98
2026-11-05 09:04:33 10.0.0.7 GET /courses/sql 200 395
2026-11-05 09:05:02 10.0.0.8 GET /missing 404 28"""

PATTERN = re.compile(
    r"^(?P<date>\d{4}-\d{2}-\d{2}) (?P<time>\d{2}:\d{2}:\d{2}) "
    r"(?P<ip>\S+) (?P<method>[A-Z]+) (?P<path>\S+) (?P<status>\d{3}) (?P<ms>\d+)$"
)

def parse(text):
    entries, skipped = [], []
    for number, line in enumerate(text.splitlines(), 1):
        m = PATTERN.match(line)
        if not m:
            skipped.append((number, line))
            continue
        e = m.groupdict()
        e["status"] = int(e["status"])
        e["ms"] = int(e["ms"])
        entries.append(e)
    return entries, skipped

entries, skipped = parse(LOG)
print("parsed:", len(entries), "skipped:", len(skipped))
print("skipped line:", skipped[0])
print(entries[2])

Open in editor »

Read the pattern piece by piece: a date, a time, then \S+ (any run of non-space characters) for the IP and path, [A-Z]+ for the method, three digits for the status and digits for the milliseconds. Converting status and ms to int straight away means later code can compare and add them.

Your turn: write the code

Write parse_status(line) that returns the status code (an int) from a line like GET /home 200, or None if the line does not end with a 3-digit status. Print the result for GET /home 200, GET /x 404 and garbage.

Quick check

Why keep unreadable lines aside instead of ignoring them?

You can see how much of the log could not be parsedPython requires itThey make the program faster

Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.

Tip: use the left and right arrow keys to move between lessons.