Reputation: 13
I have a log that generate this kind of entry
<135>Oct 20 11:10:49 Oct 20 11:10:56.085 CRE: authid_log_card()- authid: 471178EAB6, type: M35XX info: Sam Smith (Keyholder) (card #1)
<135>Oct 20 11:17:15 Oct 20 11:17:21.913 CRE: authid_log_card()- authid: 6199559ABC, type: M22XX info: John Dawson (user #3)
<135>Oct 20 11:20:15 Oct 20 11:17:21.913 CRE: authid_log_card()- authid: 6199559ABC, type: M27XX info: Access denied
I need to find a regex able to catch the name "John Dawson" and "Same Smith" and also the "Access denied" that have no anchor point but its terminate it self I tried using this
info:\s(.?)\s(|info:(\s.?)$
but it create "two captuing group" and the software were i need to pass this log is not able to identify two capturing group each time
Any idea how to better compose this regex?
Thank you
Upvotes: 1
Views: 84
Reputation: 627607
The current regex info:\s(.*?)\s\(|info:(\s.*?)$
matches one of the two alternatives:
info:\s(.*?)\s\(
- info:
, followed with a whitespace, then any 0+ chars other than line break chars as few as possible are captured into Group 1 up to a whitespace followed with (
info:(\s.*?)$
- matches info:
and then captures a whitespace and any 0+ chars other than line break chars into Group 1, as few as possible but up to the end of string.You may actually use one capturing group to match any 0+ chars as few as possible up to whitespace + (
or end of string with
info:\s*(.*?)(?=\s*\(|$)
See the regex demo
Details
info:
- a info:
substring\s*
- + whitesoaces(.*?)
- Group 1: any 0+ chars other than line break chars, as few as possible up to but not including...(?=\s*\(|$)
- 0+ whitespaces and (
(with \s*\(
) or (|
) the end of string ($
) (or line if you are using a tool like Grok or a text editor.)Upvotes: 1