How to quickly find and substring multible items from string in C++? - c++

Question

I'm rather new to C++ and I'm struggling with the following problem:
I'm parsing syslog messages from iptables. Every message looks like:
192.168.1.1:20200:Dec 11 15:20:36 SRC=192.168.1.5 DST=8.8.8.8 LEN=250
And I need to quickly (since new messages are coming very fast) parse the string to get SRC, DST and LEN.
If it was a simple program, I'd use std::find to find index of STR substring, then in a loop add every next char to an array until I encounter a whitespace. Then I'd do the same for DST and LEN.
For example,
std::string x = "15:30:20 SRC=192.168.1.1 DST=15.15.15.15 LEN=255";
std::string substr;
std::cout << "Original string: \"" << x << "\"" << std::endl;
// Below "magic number" 4 means length of "SRC=" string
// which is the same for "DST=" and "LEN="
// For SRC
auto npos = x.find("SRC");
if (npos != std::string::npos) {
substr = x.substr(npos + 4, x.find(" ", npos) - (npos+4));
std::cout << "SRC: " << substr << std::endl;
}
// For DST
npos = x.find("DST");
if (npos != std::string::npos) {
substr = x.substr(npos + 4, x.find(" ", npos) - (npos + 4));
std::cout << "DST: " << substr << std::endl;
}
// For LEN
npos = x.find("LEN");
if (npos != std::string::npos) {
substr = x.substr(npos + 4, x.find('\0', npos) - (npos + 4));
std::cout << "LEN: " << substr << std::endl;
}
However, in my situation, I need to do this really quickly, ideally in one iteration.
Could you please give me some advice on this?

Answer 1

If your format is fixed and verified (you can accept undefined behavior as soon as the input string doesn't contain exactly the expected characters), then you might squeeze out some performance by writing larger parts by hand and skip the string termination tests that will be part of all standard functions.
// buf_ptr will be updated to point to the first character after the " SRC=x.x.x.x" sequence
unsigned long GetSRC(const char*& buf_ptr)
{
// Don't search like this unless you have a trusted input format that's guaranteed to contain " SRC="!!!
while (*buf_ptr != ' ' ||
*(buf_ptr + 1) != 'S' ||
*(buf_ptr + 2) != 'R' ||
*(buf_ptr + 3) != 'C' ||
*(buf_ptr + 4) != '=')
{
++buf_ptr;
}
buf_ptr += 5;
char* next;
long part = std::strtol(buf_ptr, &next, 10);
// part is now the first number of the IP. Depending on your requirements you may want to extract the string instead
unsigned long result = (unsigned long)part << 24;
// Don't use 'next + 1' like this unless you have a trusted input format!!!
part = std::strtol(next + 1, &next, 10);
// part is now the second number of the IP. Depending on your requirements ...
result |= (unsigned long)part << 16;
part = std::strtol(next + 1, &next, 10);
// part is now the third number of the IP. Depending on your requirements ...
result |= (unsigned long)part << 8;
part = std::strtol(next + 1, &next, 10);
// part is now the fourth number of the IP. Depending on your requirements ...
result |= (unsigned long)part;
// update the buf_ptr so searching for the next information ( DST=x.x.x.x) starts at the end of the currently parsed parts
buf_ptr = next;
return result;
}
Usage:
const char* x_str = x.c_str();
unsigned long srcIP = GetSRC(x_str);
// now x_str will point to " DST=15.15.15.15 LEN=255" for further processing
std::cout << "SRC=" << (srcIP >> 24) << "." << ((srcIP >> 16) & 0xff) << "." << ((srcIP >> 8) & 0xff) << "." << (srcIP & 0xff) << std::endl;
Note I decided to write the whole extracted source IP into a single 32 bit unsigned. You can decide on a completely different storage model if you want.
Even if you can't be optimistic about your format, using a pointer that is updated whenever a part is processed and continuing with the remaining string instead of starting at 0 might be a good idea to improve performance.
Ofcourse, I suppose your std::cout << ... lines are just for development testing, because otherwise all micro optimization becomes useless anyway.

Answer 2

"quickly, ideally in one iteration" - in reality, the speed of your program does not depend on the number of loops that are visible in your source code. Especially regex'es are a very good way to hide multiple nested loops.
Your solution is actually pretty good. It doesn't waste much time prior to finding "SRC", and doesn't search further than necessary to retrieve the IP address. Sure, when searching for `"SRC" it has a false positive on the first "S" of "Sep", but that is solved by the next compare. If you know for certain that the first occurrence of "SRC" is somewhere in column 20, you might save just a tiny bit of speed by skipping those first 20 characters. (Check your logs, I can't tell)

Answer 3

You can use std::regex, e.g.:
std::string x = "15:30:20 SRC=192.168.1.1 DST=15.15.15.15 LEN=255";
std::regex const r(R"(SRC=(\S+) DST=(\S+) LEN=(\S+))");
std::smatch matches;
if(regex_search(x, matches, r)) {
std::cout << "SRC " << matches.str(1) << '\n';
std::cout << "DST " << matches.str(2) << '\n';
std::cout << "LEN " << matches.str(3) << '\n';
}
Note that matches.str(idx) creates a new string with the match. Using matches[idx] you can get the iterators to the sub-string without creating a new string.