CODEWITHSUNDEEP
regexsplunk
Kim Kiamco
Kim Kiamco

Reputation: 3

regex:how to specify and end of the capture

lets say I har raw data thats like this

  ERROR -- : FluentLogger: Can't convert to msgpack: (blah: blah: balh:.... ):

I want to capture 

FluentLogger: Can't convert to msgpack:

currently I have this 

(?>ERROR -- :)(?<msg1>.*):

but the problem with this is that it would capture 

FluentLogger: Can't convert to msgpack: (blah: blah: balh:.... ):

how would I write the regex for that?

Upvotes: 0

Views: 96

Answers (3)

user3005774
user3005774

Reputation: 11

One or more 'not :' by ':' use 

[^:]+:

To find the first two of these in a string

/[^:]+:[^:]+:/

To capture the first two of these after ERROR -- : in a string

(?>ERROR -- :)(?[^:]+:[^:]+:)

Upvotes: 0

Rahul Desai
Rahul Desai

Reputation: 15501

Use this regex: /ERROR -- : ([A-Za-z]+:[\s\w']+):/g

Demo and explanation

Upvotes: 1

builder-7000
builder-7000

Reputation: 7627

You can do:

(?<=ERROR -- : ).*msgpack:

Note this is close to your original attempt:

(?>ERROR -- :)(?<msg1>.*):

but not quite, since you use ?> for look behind, but it should have been (?<=).

Upvotes: 0

Related Questions