CODEWITHSUNDEEP
regexpcre
Josh
Josh

Reputation: 25

RegEx for matching one to three words after a keyword

I have syslog like:

Apr 22 11:52:44 localhost systemd: Stopped logstash. 
Apr 22 11:52:07 localhost systemd: Started Getty on tty1. 
Apr 22 11:52:07 localhost systemd: Started Hostname Service. 
Apr 22 11:52:07 localhost systemd: Started Import network configuration from initramfs.

I wanna get 3 words after status (short program name).

My solution: 

"\bsystemd:\s+\S+\s\K\S+\s\S+\s\S+"

But, program name can be less than 3 words (like logstash in my log), thats why I need a regex to match 1 or 2 or 3 words depending on the length of the string.

How do I solve this problem?

Upvotes: 1

Views: 91

Answers (1)

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 626699

You may use

\bsystemd:\s+\S+\s\K\S+(?:\s\S+){0,2}

See the regex demo.

The \S+(?:\s\S+){0,2} part does the job: it matches 1+ non-whitespace chars followed with 0 to 2 repetitions of 1+ whitespaces followed with 1+ non-whitespace chars.

See the regex graph:

enter image description here

enter image description here

Upvotes: 1

Related Questions