需要正则表达式来匹配第一个实例直到下一个实例（不包括下一个“前瞻”）Java

Question

I'm new to programming and regular expressions so that's my disclaimer.

I'm trying to parse my way through a wireshark log that I've transferred over to a txt file using tshark.

The point of my program is to start at the top of the txt file and match all text between packet headers.

All packets begin with Frame\\s+\\d , which excluding the next packet header and drop that text in a string.

I'm instantiating an object ( Packets ) and then adding them to an ArrayList for later processing.

I need to gather all text from packet header 1 to end of packet 1 / beginning of packet header 2, without including packet header 2.

Frame 1 (186 bytes on wire, 186 bytes captured)
    Arrival Time: Sep 19, 2013 13:25:19.937150000
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 186 bytes
    Capture Length: 186 bytes
    [Frame is marked: False]
    [Protocols in frame
............................A bunch of more packet data...............
    Encrypted Packet: 88FE0AFA38B3E1994B907F778FC42CD4FBD967F3D9101679...

Frame 2 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Sep 19, 2013 13:25:19.938495000
    [Time delta from previous captured frame: 0.001345000 seconds]
    [Time delta from previous displayed frame: 0.001345000 seconds]

I've tried:

(Frame\s\d)*.?Frame\s\d

But not dice.

I've been plugging away on rubular.com to see if I can hit paydirt on this but I can't seem to match what I need.

Thoughts?

Answer 1

Considering a file packets.txt in /your/path , containing the example you posted...

Here's a solution.

try {
    // trivial file operations
    String path = "/your/path/packets.txt";
    File file = new File(path);
    BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(file)));
    String line = null;
    StringBuilder contents = new StringBuilder();
    while ((line = br.readLine()) != null) {
        contents.append(line);
    }
    br.close();
    // the Pattern
    Pattern p = Pattern.compile("Frame\\s\\d\\s(.+?(?=Frame|$))", Pattern.MULTILINE);
    // If you actually need the "Frame etc." header matched as well, here's
    // an alternate Pattern:
    // Pattern p = Pattern.compile("(Frame\\s\\d\\s.+?(?=Frame|$))", Pattern.MULTILINE);
    // matching...
    Matcher m = p.matcher(contents);
    // iterating over matches and printing out group 1
    while (m.find()) {
        System.out.println("Found: " + m.group(1));
    }
}
// "handling" FileNotFoundException
catch (Throwable t) {
    t.printStackTrace();
}

Output:

Found: (186 bytes on wire, 186 bytes captured)    Arrival Time: Sep 19, 2013 13:25:19.937150000    [Time delta from previous captured frame: 0.000000000 seconds]    [Time delta from previous displayed frame: 0.000000000 seconds]    [Time since reference or first frame: 0.000000000 seconds]    
Found: (60 bytes on wire, 60 bytes captured)    Arrival Time: Sep 19, 2013 13:25:19.938495000    [Time delta from previous captured frame: 0.001345000 seconds]    [Time delta from previous displayed frame: 0.001345000 seconds]

Explanation of the Pattern :

• It looks for text starting with your original pattern more or less ("Frame, space, digit, space")
• It stores whatever comes next including line breaks, but stops when either a new "Frame" text appears, or the end of the input text does
• The text matching point 2 is stored in a group (group 0 is the whole match, specific groups start at index 1)

Edit: hints on performance and memory optimization

• Small step but obvious: declare the Pattern as a constant so it compiles only once

• Instead of populating an ArrayList which will grow with every match, write each match to a single file in some folder - this will perform slowly, but if well implemented, should allow garbage collection to take place for the matched String at each iteration of the while (m.find()) loop

• Once the iteration has terminated, you will have to process each small file iteratively again

• If this is not sufficient or just doesn't work against the size of your data, you might want to implement your own custom parser, or pre-chunk the data somehow, but this is quite out of scope, considering your original question was about the Pattern itself, not the performance