from pyparsing import Word, alphas, Suppress, Combine, nums, string, Optional, Regex


class LogGrammar(object):
    """A class to define the format (grammar) of a log file.

    We heavily rely on pyparsing in this case. The code for auth.log grammar is derived from syslog parser
    by L. Silva [Silva2012]_.

    References
    ----------
    .. [Silva2012] L. Silva, Parsing syslog files with Python and PyParsing, 2012.
                   https://gist.github.com/leandrosilva/3651640
    """
    def __init__(self, log_type=None):
        """The constructor of LogGrammar.
        """
        self.log_type = log_type
        self.authlog_grammar = self.__get_authlog_grammar()
        self.kippolog_grammar = self.__get_kippolog_grammar()

    @staticmethod
    def __get_authlog_grammar():
        """The definition of auth.log grammar.
        """
        ints = Word(nums)

        # timestamp
        month = Word(string.uppercase, string.lowercase, exact=3)
        day = ints
        hour = Combine(ints + ":" + ints + ":" + ints)
        timestamp = month + day + hour

        # hostname, service name, message
        hostname_or_ip = Word(alphas + nums + "_" + "-" + ".")
        appname = Word(alphas + "/" + "-" + "_" + ".") + Optional(Suppress("[") + ints + Suppress("]")) + Suppress(":")
        message = Regex(".*")

        # auth log grammar
        authlog_grammar = timestamp + hostname_or_ip + appname + message
        return authlog_grammar

    def parse_authlog(self, log_line):
        """Parse auth.log based on defined grammar.

        Returns
        -------
        parsed  : dict[str, str]
            A parsed auth.log containing these elements: timestamp, hostname, service, pid, and message.
        """
        parsed_authlog = self.authlog_grammar.parseString(log_line)

        # get parsed auth.log
        parsed = dict()
        parsed['timestamp'] = parsed_authlog[0] + ' ' + parsed_authlog[1] + ' ' + parsed_authlog[2]
        if self.log_type == 'Hofstede2014':
            parsed['ip_address'] = parsed_authlog[3]
        else:
            parsed['hostname'] = parsed_authlog[3]

        parsed['service'] = parsed_authlog[4]

        if len(parsed_authlog) < 7:
            parsed['message'] = parsed_authlog[5]
        else:
            parsed['pid'] = parsed_authlog[5]
            parsed['message'] = parsed_authlog[6]

        return parsed

    @staticmethod
    def __get_kippolog_grammar():
        ints = Word(nums)

        # date and time
        date = Combine(ints + '-' + ints + '-' + ints)
        time = Combine(ints + ':' + ints + ':' + ints + '+0000')
        datetime = date + time

        # service = activity, port, and ip address
        ip_address = Word(nums + '.')
        activity = Word(alphas + nums + '-' + ' ') + Optional(Suppress(',') + ints + Suppress(',') + ip_address)
        service = Suppress('[') + activity + Suppress(']')

        # message
        message = Regex(".*")

        # kippo honeypot log grammar
        kippolog_grammar = datetime + service + message
        return kippolog_grammar

    def parse_kipplog(self, log_line):
        parsed_kippolog = self.kippolog_grammar.parseString(log_line)
        return parsed_kippolog

lg = LogGrammar()
# msg = '2017-02-23 14:58:33+0000 [-] unauthorized login:'
msg = '2017-02-23 14:58:34+0000 [SSHService ssh-userauth on HoneyPotTransport,13943,113.195.145.21] ' \
      'root trying auth password'
result = lg.parse_kipplog(msg)
print result

@@ -3205,287 +3205,476 @@
     
-return parsed_kippolog%0A%0Alg = LogGrammar()%0A# msg = '2017-02-23 14:58:33+0000 %5B-%5D unauthorized login:'%0Amsg = '2017-02-23 14:58:34+0000 %5BSSHService ssh-userauth on HoneyPotTransport,13943,113.195.145.21%5D ' %5C%0A      'root trying auth password'%0Aresult = lg.
+parsed = dict()%0A        parsed%5B'timestamp'%5D = parsed_kippolog%5B0%5D + ' ' + parsed_kippolog%5B1%5D%0A        if len(parsed_kippolog) %3C 5:%0A            parsed%5B'service'%5D = parsed_kippolog%5B2%5D%0A            parsed%5B'message'%5D = parsed_kippolog%5B3%5D%0A        else:%0A            parsed%5B'service'%5D = parsed_kippolog%5B2%5D%0A            parsed%5B'port'%5D = parsed_kippolog%5B3%5D%0A            parsed%5B'ip_address'%5D = 
 parse
+d
 _kipp
+o
 log
-(msg)%0Aprint result
+%5B4%5D%0A            parsed%5B'message'%5D = parsed_kippolog%5B5%5D%0A%0A        return parsed
 %0A

Add dictionary for each property