从日志文件中提取Regex直到序列

Question

i have the below log file, i need to define the log formate using regex so i can use it for extraction of logs entries.

_20131005_022047874 ALEPO@ALEPO3 **Exception ServiceConnection / createService methord javax.xml.ws.WebServiceException: Failed to access the WSDL at: http://212.118.158.21:8080/tunnel-web/axis/Portlet_ase_FunctionalDomainService?wsdl. It failed with: 
    Connection refused.
    at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.tryWithMex(RuntimeWSDLParser.java:151)
    at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:133)
    at com.sun.xml.internal.ws.client.WSServiceDelegate.parseWSDL(WSServiceDelegate.java:254)
    at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:217)
    at com.sun.xml.internal.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:165)
    at com.sun.xml.internal.ws.spi.ProviderImpl.createServiceDelegate(ProviderImpl.java:93)
    at javax.xml.ws.Service.<init>(Service.java:56)
    at javax.xml.ws.Service.create(Service.java:680)
    at com.stc.alepo.client.ServiceConnection.createService(ServiceConnection.java:75)
    at com.stc.alepo.client.WSSoapHandler.<init>(WSSoapHandler.java:73)
    at com.stc.alepo.client.WSProcessManager.<init>(WSProcessManager.java:114)
    at com.stc.alepo.client.IcmsAlepoRealTime.start(IcmsAlepoRealTime.java:439)
    at com.stc.alepo.client.IcmsAlepoRealTime.main(IcmsAlepoRealTime.java:97)
Caused by: java.net.ConnectException: Connection refused
    at java.net.PlainSocketImpl.socketConnect(Native Method)
    at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:351)
    at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:213)
    at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:200)
    at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:366)
    at java.net.Socket.connect(Socket.java:529)
    at java.net.Socket.connect(Socket.java:478)
    at sun.net.NetworkClient.doConnect(NetworkClient.java:163)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:394)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:529)
    at sun.net.www.http.HttpClient.<init>(HttpClient.java:233)
    at sun.net.www.http.HttpClient.New(HttpClient.java:306)
    at sun.net.www.http.HttpClient.New(HttpClient.java:323)
    at sun.net.www.protocol.http.HttpURLConnection.getNewHttpClient(HttpURLConnection.java:970)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:911)
    at sun.net.www.protocol.http.HttpURLConnection.connect(HttpURLConnection.java:836)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1172)
    at java.net.URL.openStream(URL.java:1010)
    at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.createReader(RuntimeWSDLParser.java:793)
    at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.resolveWSDL(RuntimeWSDLParser.java:251)
    at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:118)
    ... 11 more

_20131005_022047874 ALEPO@ALEPO3 **Exception DCPSoapHandler / constructor methord [Ljava.lang.StackTraceElement;@25b65b7f
_20131005_022047875 ALEPO@ALEPO3 WS17249866 **Exception DCPSoapHandler / invokeSOAPMessage methord java.lang.NullPointerException
    at com.stc.alepo.client.WSSoapHandler.invokeSOAPMessage(WSSoapHandler.java:110)
    at com.stc.alepo.client.WSProcessManager.getWSReply(WSProcessManager.java:174)
    at com.stc.alepo.client.IcmsAlepoRealTime.start(IcmsAlepoRealTime.java:441)
    at com.stc.alepo.client.IcmsAlepoRealTime.main(IcmsAlepoRealTime.java:97)

i have defined the below regex to match the time stamp in addition to the first line for each entry, but i need the second group to have the rest of the message including the multiline,

(_\d{1,8}_\w+) (.*)

how to i match the second group to extract all characters until the first group occure again, or what is the best practice to do this use case. i have many logs and i would need to define the second group the same way, wihile may be the timestamp formate will change over logs.

thanks in advance.

Answer 1

You may use a regex that will capture the time stamp into 1 group and all lines after it that do not start with the time stamp pattern into Group 2:

/^(_\d{1,8}_\w+)\s*(.*(?:\r?\n(?!_\d{1,8}_\w+).*)*)/gm

See the regex demo .

Details :

• ^ - start of a line
• (_\\d{1,8}_\\w+) - Group 1 (timestamp): _ , 1 to 8 digits, _ and 1+ word chars
• \\s* - 0+ whitespaces
• (.*(?:\\r?\\n(?!_\\d{1,8}_\\w+).*)*) - Group 2 (all up to the next time stamp):
  • .* - any 0+ chars other than line break chars
  • (?:\\r?\\n(?!_\\d{1,8}_\\w+).*)* - 0+ sequences of:
    • \\r?\\n(?!_\\d{1,8}_\\w+) - a linebreak not followed with the timestamp pattern
    • .* - any 0+ chars other than line break chars