Regex for email headers and merging into a single expression

Question

I'm a bit of a novice with Regex and I'm trying to create an expression that can pull out key bits of data from my email header. I have some of the individual expressions but I'm unsure how to group them all together.

Take this example:

 ** PROBLEM Service Alert: ho-server-01 /Disk Usage is WARNING **

I want to be able to pull out:

• The first word e.g. PROBLEM - (\w+)
• The server (after :) e.g. ho-server-01 - (?<=:)(.*)(?<=\s) - I want everything from : to the end of the server name but this is wrong currently
• The status (after /) e.g. Disk Usage is WARNING - (?<=/)(.*)(?<=\s) - I want everything from the / to the end of the end of WARNING but this is wrong.

Then I want to make this into a single regex expression. I believe we use the [a|b|c] but I might be wrong.

Some more example headers:

** PROBLEM Service Alert: ho-server-01 /Disk Usage is WARNING **
** PROBLEM Service Alert: ho-server-01 /File Director Component Service is CRITICAL **
** RECOVERY Service Alert: ho-server-01 /File Director Component Service is OK **
** RECOVERY Service Alert: ho-server-01 /Drive H: Disk Usage is OK **

Any help would be much appreciated. Cheers.

Answer 1

One option is to use 3 capture groups with a single expression instead of multiple separate ones.

^\*\*\s+(\w+)\s[^:]*:\s+(\S+)\s+/(.+?)\s+\*\*$

Explanation

• ^ Start of string
• \*\* Match **
• \s+(\w+)\s Capture in group 1 matching 1+ word chars between whitespace chars
• [^:]*:\s+ match 0+ times any char other than :, then match : and 1+ whitespace chars
• (\S+) Capture group 2, match 1+ times a non whitespace char (or use (\w+(?:-\w+)+) for a more precise match)
• \s+/ Match 1+ whitespace chars and /
• (.+?) Capture group 3, match 1+ times any char as least as possible (non greedy)
• \s+\*\* Match 1+ whitespace chars and **
• $ End of string

Regex demo