Java Regular Expression for Syslog Message not working

Question

I'm trying to develop a Java program that matches syslog messages.

The pattern is like this:

"%FACILITY-[SUBFACILITY-]SEVERITY-MNEMONIC: description"

At first I did this regex and it worked for some messages:

(%[a-zA-Z_-]+-[0-6]-[a-zA-Z_-]+[^\r\t\n]+)

Now I need to match only the part before the ":" (i.e, %FACILITY-[SUBFACILITY-]SEVERITY-MNEMONIC) so I'm doing the following, which does not work:

(%[a-zA-Z_-]+-[0-6]-[a-zA-Z_-]+)

I've found some online test pages and the surprising thing is that on the first one the string matches, but not the second (this one is for Java code).

http://www.regexr.com/ -> Match

http://www.regexplanet.com/advanced/java/index.html -> Does not match

This are the strings I'm trying to match:

%HA-REDCON-4-FAILOVER_REQUEST[0x767443be74] Record Reboot History, reboot cause = 0x4000004, descr = Cause: Initiating switch-over.

%ROUTING-FIB-3-ASSERT error message may occur when doing a RCC check.

Anyone has any idea about this? What am I missing?

Thanks in advance.

To match everything before :, use ^[^:]+ regex. See regex101.com/r/kW5uY4/1 (it will work with Java, too). Just do not use "matches", since it checks the whole string capture. Or, use a capturing group with matches: ([^:]+):.*. — Wiktor Stribiżew
– Wiktor Stribiżew, Commented Apr 21, 2015 at 10:40

Wiktor Stribiżew · Accepted Answer · 2015-04-21 12:51:43Z

1

To match everything before :, use ^[^:]+ regex.

See demo (it will work with Java, too, with find()).

The matches() in Java just must match the whole string, that is why regexplanet.com says there is no match (but find() shows success).

If you want to use matches(), you need to extend the regex to the string end, and only grab the first capturing group: ([^:]+):.*.

Here is a link to a sample program showing how to capture multiple matches.

String str = "%ROUTING-FIB-3-ASSERT more words here\n%HA-REDCON-4-FAILOVER_REQUEST[0x767443be74] Record Reboot History, reboot cause = 0x4000004, descr = Cause: Initiating switch-over.";
String rx = "(?i)(%[a-z_-]+-[0-6]-[a-z_-]+)";
Pattern ptrn = Pattern.compile(rx);
Matcher m = ptrn.matcher(str);
while (m.find()) {
    System.out.println(m.group(0));
}

edited Apr 21, 2015 at 12:51

answered Apr 21, 2015 at 10:55

Wiktor Stribiżew

631k41 gold badges502 silver badges632 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ralph Wigum Over a year ago

Thanks for the reply. I actually could do it for those cases with the colon. However, now I need a match for messages that do not have the colon, for example: %ROUTING-FIB-3-ASSERT error message may occur when doing a RCC check do u know which regex can match this?

Wiktor Stribiżew Over a year ago

Are these all the requirements, or will there be more? Well, for those, you can certainly use your own regex (?i)(%[a-z_-]+-[0-6]-[a-z_-]+), but you'd better use it with Matcher.find() method. Do you want me to provide sample Java code? Here is a sample program: tutorialspoint.com/…

Collectives™ on Stack Overflow

Java Regular Expression for Syslog Message not working

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related