我是C＃的新手，我已经向stackoverflow提交了一个问题，但我解决了这个问题（C#: Log parsing date/time with regex, when there's an anomaly of >1 second, I want to save that whole line to a new file）。
现在，这是日志输出的样子：
<FLTR> <TID: 0000000461> <RPC ID: 0072606623> <Queue: Fast > <Client-RPC: 390620 > <USER: lkoporec > <Overlay-Group: 1 > /* Mon Feb 26 2018 13:53:04.4230 */ <Filter Level:0 Number Of Filters:10> Checking "SHR:LHP:InitSvc_GetServiceContextFlag" (0)
<API > <TID: 0000000373> <RPC ID: 0072606628> <Queue: List > <Client-RPC: 390620 > <USER: Remedy Application Service > <Overlay-Group: 1 > /* Mon Feb 26 2018 13:53:06.1140 */ +BE ARBulkEntry -- user Remedy Application Service from Normalization Engine (protocol 24) at IP address 10.122.26.197 using RPC // :q:0.1s
<FLTR> <TID: 0000000445> <RPC ID: 0072611490> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:53:43.3600 */ <Filter Level:0 Number Of Filters:3> Checking "FB:SetGroupForSmartReportingKPIs_3" (530)
<API > <TID: 0000000382> <RPC ID: 0072611493> <Queue: List > <Client-RPC: 390620 > <USER: darzupan > <Overlay-Group: 1 > /* Mon Feb 26 2018 13:53:46.5240 */ +EXPQRY ARExpandQueryMenu -- from Mid-tier (protocol 23) at IP address 10.122.0.61 using RPC // :q:0.0s
<FLTR> <TID: 0000000457> <RPC ID: 0072646830> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:19.5660 */ <Filter Level:0 Number Of Filters:1> Checking "FB:SetGroupForSmartReportingKPIs_GetLabel" (502)
<FLTR> <TID: 0000000345> <RPC ID: 0072647870> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:30.4330 */ <Filter Level:0 Number Of Filters:3> Checking "FB:SetGroupForSmartReportingKPIs_3" (530)
<FLTR> <TID: 0000000441> <RPC ID: 0072647871> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:30.4480 */ --> Disabled -- filter is ignored
<FLTR> <TID: 0000000460> <RPC ID: 0072648393> <Queue: Fast > <Client-RPC: 390620 > <USER: esribar > <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:35.3710 */ <Filter Level:0 Number Of Filters:123> Checking "INT:SRMHPD:INC:UpdateRequest_99_SetSRAppRegistryGUID" (99)
<FLTR> <TID: 0000000460> <RPC ID: 0072648393> <Queue: Fast > <Client-RPC: 390620 > <USER: esribar > <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:35.4250 */ Application-Copy-Field-Value 600000001 1000003890
<SQL > <TID: 0000000457> <RPC ID: 0000000000> <Queue: Admin > <Client-RPC: 390600 > <USER: > <Overlay-Group: 0 > /* Mon Feb 26 2018 13:58:41.8550 */ Generating prepared statement
<FLTR> <TID: 0000000447> <RPC ID: 0072648992> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:41.9020 */ --> Disabled -- filter is ignored
<SQL > <TID: 0000000346> <RPC ID: 0072649991> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:51.9350 */ COMMIT TRANSACTION
<API > <TID: 0000000439> <RPC ID: 0072650203> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:58:53.7280 */ +CE ARCreateEntry -- schema FB:History from Flashboards (protocol 22) at IP address 10.122.26.197 using RPC // :q:0.0s
<SQL > <TID: 0007483686> <RPC ID: 0000000000> <Queue: Escalation> <Client-RPC: 0 > <USER: > <Overlay-Group: 0 > /* Mon Feb 26 2018 14:06:48.7630 */ Generating prepared statement
<SQL > <TID: 0000000447> <RPC ID: 0000000000> <Queue: Admin > <Client-RPC: 390600 > <USER: > <Overlay-Group: 0 > /* Mon Feb 26 2018 14:06:52.1940 */ OK
<SQL > <TID: 0000000457> <RPC ID: 0072764627> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 14:18:10.5700 */ OK
看那些TID？发生的每个元素都有自己的线程ID，因此一个元素可以包含分散在一个.log文件中的100个TID。
如何在超时发生时捕获TID（previousLine），在原始.log文件中搜索该TID，并将引用该TID的每一行导出到新文件中（当然，对于每次执行的超时都会这样做）发生）？
使用新的正则表达式/日期时间功能？是否有可能只获取TID（因为它们对于元素始终是相同的，RPC ID而其余部分不是 - 在此输出中TID：0000000447会发生两次TID，但彼此不同）。
这是我的代码到目前为止的样子：
using System;
using System.Globalization;
using System.IO;
using System.Text.RegularExpressions;
namespace LogParser
{
class Program
{
static void Main(string[] args)
{
Console.OutputEncoding = System.Text.Encoding.UTF8;
var counterLine = 0;
var counterTimeout = 0;
var line = string.Empty;
var previousLine = string.Empty;
var previousDt = DateTime.MaxValue;
var tidLine = string.Empty;
var regex = new Regex(@"\d{2}:\d{2}:\d{2}\.\d{4}");
try
{
var file = new System.IO.StreamReader(args[0]);
Console.WriteLine("Profesionalno branje logov se začenja:\n");
using (var writer = new StreamWriter(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Desktop), "log_output.txt"), true))
{
while ((line = file.ReadLine()) != null)
{
counterLine++;
foreach (Match m in regex.Matches(line))
{
var dt = new DateTime();
if (DateTime.TryParseExact(m.Value, "HH:mm:ss.ffff", null, DateTimeStyles.None, out dt))
{
if ((dt - previousDt).TotalSeconds > 1)
{
counterTimeout++;
Console.WriteLine(previousLine);
Console.WriteLine(line + "\n\n\n");
writer.WriteLine(previousLine);
writer.WriteLine(line + Environment.NewLine);
}
previousLine = line;
previousDt = dt;
}
}
}
}
file.Close();
Console.WriteLine("\nBranje logov je končano. Prebrali smo: {0} vrstic ter izpisali " +
"{1} vrstic, kjer je bil timeout v datoteko.", counterLine, counterTimeout);
}
catch (Exception e)
{
Console.OpenStandardError();
Console.WriteLine(e.Message);
}
if (args.Length < 1)
{
Console.OpenStandardError();
Console.WriteLine("Uporaba: {0} LOG_FILE", AppDomain.CurrentDomain.FriendlyName);
Console.ReadKey();
return;
}
}
}
}
最终结果应该看起来像这样（对于每个TID）：
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5920 */ <Filter Level:0 Number Of Filters:2> Checking "FB:SetGroupForSmartReportingKPIs" (505)
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5920 */ --> Disabled -- filter is ignored
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5930 */ <Filter Level:0 Number Of Filters:2> Checking "FB:SetGroupForSmartReportingKPIs_1" (510)
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5930 */ --> Disabled -- filter is ignored
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5930 */ <Filter Level:0 Number Of Filters:2> Checking "FB:SetGroupForSmartReportingKPIs_2" (520)
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > --> Passed -- perform actions
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > 0 : Set Fields
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5940 */ Generating prepared statement
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5950 */ OK
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5950 */ Binding [5] parameters to prepared statement
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5950 */ OK
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5950 */ WITH AR_SQL_Alias$1 AS (SELECT T72.C179, T72.C1, ROW_NUMBER() OVER (ORDER BY T72.C1 ASC) AS 'AR_RowNumber_Alias$1' FROM T72 WHERE ((N'{78DF8F98-D170-48A2-A7A8-0B2E2BB6931C}' = T72.C179) AND ((T72.C41050 = N'CMDB:Total_Base_CI') OR (T72.C41050 = N'CMDB:Total_Relationship_CI')))) SELECT AR_SQL_Alias$1.C179, AR_SQL_Alias$1.C1 FROM AR_SQL_Alias$1 WHERE (AR_SQL_Alias$1.AR_RowNumber_Alias$1 BETWEEN 0 AND 3)
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5960 */ OK
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > Label Group5 (40111) =
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5960 */ <Filter Level:0 Number Of Filters:3> Checking "FB:SetGroupForSmartReportingKPIs_3" (530)
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > --> Failed qualification
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5960 */ <Filter Level:0 Number Of Filters:4> Checking "FB:SetGroupForSmartReportingKPIs_4" (540)
<FLTR> <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > --> Failed qualification
<SQL > <TID: 0000000447> <RPC ID: 0000000000> <Queue: Admin > <Client-RPC: 390600 > <USER: > <Overlay-Group: 0 > /* Mon Feb 26 2018 13:52:08.5980 */ OK
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5980 */ INSERT INTO T251(C7,C40000,C40100,C40104,C40106,C40108,C40102,C40101,C40103,C40105,C40107,C40109,C2,C8,C5,C3,C6,C1) VALUES(0,N'{78DF8F98-D170-48A2-A7A8-0B2E2BB6931C}',1000000164,1000000217,1000000001,303497300,1358879400,2.00,N'2',N'TS3111 Merilni sistemi',N'Telekom Slovenije, d.d.',N'INTERNET_11894970',N'Remedy Application Service',N'x',N'Remedy Application Service',1519649528,1519649528,N'000000118010138')
<SQL > <TID: 0000000447> <RPC ID: 0072599594> <Queue: Fast > <Client-RPC: 390619 > <USER: Remedy Application Service -- Impersonated by Remedy Application Service --> <Overlay-Group: 1 > /* Mon Feb 26 2018 13:52:08.5990 */ OK
等等等等（有很多行，所以我把它们剪掉了）。
我在你想要的东西上遇到了一些麻烦，我只是复制了你的输入和所需的输出，但我无法理解你寻求的模式究竟是什么。如果你能给出一个简化的例子，那将有所帮助，因为正则表达式与变量模式非常相似。
根据您的要求，这是我推荐的工作流程：
使用一个while循环，其中Regex.IsMatch是条件。虽然您始终符合您的条件，但循环仍在继续并提取您的信息。
对于匹配模式本身，根据您的要求，查找超时模式的样子（我无法分辨），您可以使用它来获取下一行：
(timeoutpattern.*[\r\n]+).*
这将匹配timeoutpattern本身，但在循环中将需要。
在进行此匹配并保存为字符串变量时，使用Regex.Replace将其从原始字符串中删除，并将其替换为""
然后从原始字符串替换（timeoutpattern）。*？用“”完全删除它（你得到你想要的输出）。