CODEWITHSUNDEEP
regexregex-negation
citrixcanuck1
citrixcanuck1

Reputation: 1

Regex Negative Lookahead using group defined earlier in match

I'm trying to write a regex to parse a log file that's generated by several hundred of our routers. The log is a script that tries to ping each of the other routers in the environment. This is for compliance to prove that we can't ping each of the other routers in the environment. The logs look similar to the following excerpt (only much larger).

Interface Name = INTNET1
IP Address                     =   192.168.200.200,

---PING Section---
PING 192.168.200.200: 56 data bytes
64 bytes from 192.168.200.200: icmp_seq=0. time=0. ms
64 bytes from 192.168.200.200: icmp_seq=1. time=0. ms
----192.168.200.200 PING Statistics----
2 packets transmitted, 2 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 0/0/0
no answer from 192.168.12.13
no answer from 192.168.151.1
no answer from 192.168.19.1
no answer from 192.168.84.1
64 bytes from 192.168.100.100: icmp_seq=0. time=0. ms
64 bytes from 192.168.100.100: icmp_seq=1. time=0. ms
----192.168.100.100 PING Statistics----
2 packets transmitted, 2 packets received, 0% packet loss
round-trip (ms)  min/avg/max = 0/0/0

Because all of the routers are listed in the script, each router will ping itself and receive a positive reply. Using this to gather the router's mgmt. IP:

IP\sAddress\s*\=\s*(?<MGMTIP>.*)

I want to negatively lookahead through the matches of the following pattern (the PING Statistics lines)

\-\-\-\-(.*)\-\-\-\-

and only match if it the address isn't a match with the named group. I've been hacking away at it for a while now and just can't seem to make it work.

EDIT: I wonder if I'm over-complicating this. All I really need out of this whole string block is to match any lines with this pattern:

\-\-\-\-(.*)\-\-\-\-

But only capture the '(.*)' part if it doesn't match Group 1 from this pattern (which matches the IP address of the host issuing the pings)

IP\sAddress\s*\=\s*(.*)

Upvotes: 0

Views: 48

Answers (1)

emsimpson92
emsimpson92

Reputation: 1778

I'm not sure what language you're using so I can't give an exact answer, but this is really difficult to do with a single pattern, so I suggest using 2. The first pattern you wrote will capture your IP.

IP\sAddress\s*\=\s*(?<MGMTIP>.*)

We'll save that to a variable called "myIP" (if you're really concerned about accuracy you'll want to escape each . in "myIP" because with regex . matches any character. Chances are this won't matter though)

Your next pattern should be "(?s)----" + myIP + "\sPING\sStatistics----.*?(?=----\d+\.\d+\.\d+\.\d+\sPING\sStatistics----|\Z)"

This will match every section that you don't want. You can replace any of those matches with "" and it will leave you with all the sections you're looking for.

Demo

Upvotes: 1

Related Questions