1

So I have a text file with this format:

[2018-04-04 11:46:05.879927]c:\windows\addins\FXSEXT.ecf,[created date]2018-04-12 02:35:21,[modified date]2018-04-12 02:35:21,[access date]2018-04-12 02:35:21,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 15:46:15.336327]c:\windows\System32\AcGenral.dll,[created date]2018-09-23 04:14:27,[modified date]2018-08-09 12:13:19,[access date]2018-09-23 04:14:27,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 15:46:10.556427]c:\windows\SysWOW64\AcGenral.dll,[created date]2018-09-23 04:14:30,[modified date]2018-08-09 11:20:24,[access date]2018-09-23 04:14:30,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 12:46:12.596327]c:\windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.17134.112_none_edebf6774847bf6e\AcGenral.dll,[created date]2018-06-19 22:49:33,[modified date]2018-06-19 22:49:33,[access date]2018-06-19 22:49:33,[READ]True,[WRITE]True,[EXECUTED]True
[2019-04-02 15:46:12.596327]c:\windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.17134.165_none_edb8e7b9486d9728\AcGenral.dll,[created date]2018-08-06 06:10:19,[modified date]2018-07-06 16:53:16,[access date]2018-08-06 06:10:19,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 06:46:32.596327]c:\windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.17134.1_none_f1a4c5155b750465\AcGenral.dll,[created date]2018-04-12 02:34:40,[modified date]2018-06-19 22:53:10,[access date]2018-06-19 22:53:09,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 15:46:52.596327]c:\windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.17134.254_none_edc2b94148665f07\AcGenral.dll,[created date]2018-09-23 04:14:27,[modified date]2018-08-09 12:13:19,[access date]2018-09-23 04:14:27,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-01 13:46:12.798327]c:\windows\WinSxS\wow64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.17134.112_none_f840a0c97ca88169\AcGenral.dll,[created date]2018-06-19 22:49:39,[modified date]2018-06-19 22:49:39,[access date]2018-06-19 22:49:39,[READ]True,[WRITE]True,[EXECUTED]True
[2018-04-05 15:46:12.431127]c:\windows\WinSxS\wow64_microsoft-windows-

And all I need to do is to get specific date and string to search. And from this date I need to loop line by line inside my text file and return True is the given string is inside the text file or False otherwise (I need to search only inside line that there date is after the given date, the text file is sorted)

So first I have this regex that parses the datetime in the beginning of every line:

date is the time that I need to search from...

count = 0
text_file = open(file, 'r')
lines = text_file.readlines()
for line in lines:
    maches = regex.findall('\[(.*?)\]', line)
    if len(maches) > 0:
        currentdate = maches[0]
        count = count + 1
        if currentdate > date:
            # here I know  that from here all the next lines dates are after the given date.

Then I need to loop over all the lines and check if the given date (the variable date) is before or after the current date. If I found the line that the datetime is bigger than the given date I know the I nedd to search the string from this line.

So my question how to compare between 2 datetimes?

martineau
  • 119,623
  • 25
  • 170
  • 301
falukky
  • 1,099
  • 2
  • 14
  • 34

2 Answers2

1

Since timestamp in text is always at the start of each line, you could simply slice it rather than using regex.

from datetime import datetime

file = 'text.txt'
search_date = '2018-04-04'
search_string = 'WOW'

text_file = open(file, 'r')
lines = text_file.readlines()
search_date = datetime.strptime(search_date, '%Y-%m-%d')            # Convert to datetime

for line in lines:
    date = line[1:27]                                               # Slice date from line
    date = datetime.strptime(date, '%Y-%m-%d %H:%M:%S.%f')          # Convert to datetime
    if (date > search_date) and (search_string in line):
        print(line)

For Python >= 3.7.0, you could use datetime.fromisoformat() instead of datetime.strptime().

date = datetime.fromisoformat(date)

Community
  • 1
  • 1
Nirmal
  • 1,285
  • 2
  • 13
  • 23
  • 1
    If i am using datetime.fromisoformat(date) i dont need to specify the date format ? – falukky Apr 06 '19 at 08:21
  • The timestamps are already in ISO-8601 format, so no need to specify explicitly. [Check this answer](https://stackoverflow.com/a/49784038/7046003) – Nirmal Apr 06 '19 at 08:29
0

I don't see where you're turning your regex matched string into a datetime object. But that should be easy enough given the datetime format. Check out the datetime module docs.

Once you parse a datetime object from the row, and assuming the date variable is already a datetime object, you can use the usual > operator to compare two datetime objects. The datetime class overloads all of the usual comparison operators so that's pretty standard.

Marcin Orlowski
  • 72,056
  • 11
  • 123
  • 141
rdas
  • 20,604
  • 6
  • 33
  • 46
  • Yes thats right i need to parse my string into datetime, i need to know to datetime format in advanced ? – falukky Apr 06 '19 at 05:16
  • 1
    From your example text it should be pretty straightforward to construct they format. https://docs.python.org/3/library/datetime.html#strftime-and-strptime-behavior – rdas Apr 06 '19 at 05:17