Issue on parsing logs using regex

Question

I have tried separating the wowza logs using regex for data analysis, but I couldn't separate the section below.

I need a SINGLE regex pattern that would satisfy below both log formats.

Format 1:

live wowz://test1.example.com:443/live/_definst_/demo01|wowz://test2.example.com:443/live/_definst_/demo01 test

Format 2:

live demo01 test

I am trying to split the line on the 3 parameters and capturing them in the groups app, streamname and id, but streamname should only capture the text after the last /.

This is what I've tried:

(?<stream_name>[^/]+)$ --> Using this pattern I could only separate the format 1 "wowz" section. Not entire Format 1 example mentioned above.

Expected Output

{

"app": [
    [
        "live"
    ]
],
"streamname": [
    [
        "demo1"
    ]
],
"id": [
    [
        "test"
    ]
]

}

Can you elaborate on what lines it should match? i.e: why not any line starting with live? Or why would you use [^/]+ to match a line that actually has slashes? — Mariano
– Mariano, Commented Nov 20, 2015 at 14:35
@maraiano , I need to split "demo1" from both format logs using single regular expression. expected output: { "app": [ [ "live" ] ], "streamname": [ [ "demo1" ] ], "id": [ [ "test" ] ] } — KMG
– KMG, Commented Nov 20, 2015 at 14:47
Try ^(?<app>\S+) (?:\S*/)?(?<streamname>\S+) (?<id>\S+)$ ... Or edit your question showing the relevant part of your log and expected output in the body of your post — Mariano
– Mariano, Commented Nov 20, 2015 at 14:57
Still not clear what has to be separed from what. "demo1" means and alfanumeric id of any length? Expand the question please — RiccardoC
– RiccardoC, Commented Nov 20, 2015 at 15:07
@maraino, Solution works for me. If you post the same in solution tag, I will mark it as Correct answer — KMG
– KMG, Commented Nov 20, 2015 at 15:15

Mariano · Accepted Answer · 2015-11-20 16:01:58Z

2

You can achieve what you specified using the following regex:

^(?<app>\S+) (?:\S*/)?(?<streamname>\S+) (?<id>\S+)$

regex101 demo

\S+ matches any number of characters except whitespace.
(?:\S*/)? to optionally consume the characters in the second parameter up to the last /. This is not included in the group, so it won't be captured.

answered Nov 20, 2015 at 16:01

Mariano

6,5214 gold badges35 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

KMG Over a year ago

thanks, Its solved my Problem. I marked it as Correct Answer

KMG Over a year ago

Could you please share some link to learn regex pattern ?. Thanks once again for your kindly help

Mariano Over a year ago

regular-expressions.info/tutorialcnt.html This is the best IMO. It may take some time reading it, but that's the time you need so you can learn regex

Collectives™ on Stack Overflow

Issue on parsing logs using regex

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related