Parsing a particular log using regex?

Question

The log example is

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90 (Johns-Iphone) via eth1 relay 1.3.4.4

where 123.4.5.89 is ip address, 12:34:45:56:78:90is mac address, Johns-Iphone is Host.

Case 1 - I want this to have no matching group (missing left parenthesis)

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90 Johns-Iphone) via eth1 relay 1.3.4.4

Case 2 - This can be parsed

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90 (Johns-Iphone) via eth1 relay 1.3.4.4

Case 3 - This can be parsed as well

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90 via eth1 relay 1.3.4.4

Case 4 - This can be parsed as well

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90

Here is my regex to parse this particular log:

DHCPRELEASE\sof\s((?:[0-9]{1,3}\.){3}(?:[0-9]{1,3}))\sfrom\s((?:[a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2})(?:\s\((.*?)\))?

However my regex does NOT work what I want. Anyone can help?

Thanks!

@anubhava Case 1 does not work, it actually has matching group and can be parsed. I don't want that. — sozhen
– sozhen, Commented Dec 4, 2014 at 17:45

Community · Accepted Answer · 2020-06-20 09:12:55Z

1

You can use this regex:

DHCPRELEASE\sof\s((?:[0-9]{1,3}\.){3}(?:[0-9]{1,3}))\sfrom\s((?:[a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2})(?:\s\(([^)]*)\))?(?=\svia|$)

i.e. have a lookahead (?=\svia) in the end in order to make sure unmatched (...) is not matched for case 1.

RegEx Demo

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Dec 4, 2014 at 17:54

anubhava

790k67 gold badges603 silver badges671 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

sozhen Over a year ago

Thanks for your thoughts. What about Case 4 in my question (I just edited my question)? Is it possible? I want the parser to be very particular about what it recognizes.

1010 · Accepted Answer · 2014-12-22 03:09:56Z

0

because (?:\s$(.*?)$)? is optional you don't force the parentheses to match. it's only matching the substring

DHCPRELEASE of 123.4.5.89 from 12:34:45:56:78:90

and ignoring the rest.

You could append " via" to your regular expression to force the match until that point.

EDIT

to be more precise you could add start and end anchors to your regular expression so it matches the entire line.

for example

^DHCPRELEASE\sof\s((?:[0-9]{1,3}\.){3}(?:[0-9]{1,3}))\sfrom\s((?:[a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2})(?:\s\((.*?)\))?( via eth1 relay.*)?$

will match the entire line or nothing. note "^" to match the beginning of the line, and "$" to match the end.

edited Dec 22, 2014 at 3:09

answered Dec 4, 2014 at 17:57

1010

1,86819 silver badges28 bronze badges

1 Comment

sozhen Over a year ago

Thanks for your input 1010. I added case 4 to my question - Is is possible to have a regex fitting all my cases?

Collectives™ on Stack Overflow

Parsing a particular log using regex?

2 Answers 2

RegEx Demo

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related