Reputation: 63
I try to get a regex which returns the match in the first capture group.
The Application where I put the regex in can only use the first capture Group.
Each regex on it's own is working, but i can't combine these two in a way that the output is always in the first capture group
Input 1:
Event: Started Flapping
Regex 1:
^Event: (\S+ Flapping)
Output 1:
Started Flapping
Input 2:
Event: CRIT -> OK
Regex 2:
^Event:\s+\S+\s+\S+\s+(\S+)
Ouput 2:
OK
The Regex i tried
(?:^Event:\s+\S+\s+\S+\s+(?P<service>\S+)$|^Event: (?P<flap>Started Flapping)|((?P=service)|(?P=flap)))
Upvotes: 1
Views: 139
Reputation: 626690
You can use a branch reset group:
^Event:\s+(?|\S+\s+\S+\s+(\S+)|(Started Flapping))$
# or, to factor in \S+\s+:
^Event:\s+(?|(?:\S+\s+){2}(\S+)|(Started Flapping))$
See the regex demo. Details:
^
- start of stringEvent:
- a fixed string\s+
- one or more whitespaces(?|
- start of a branch reset group:
\S+\s+\S+\s+
- two occurrences of one or more non-whitespaces followed with one or more whitespaces(\S+)
- Group 1: one or more non-whitespaces|
- or
(Started Flapping)
- Group 1: Started Flapping
fixed string)
- end of the branch reset group$
- end of string.Upvotes: 4