writing a regular expression in java for a string present in between a line

Question

My input string is:

subtype=forward,level=notice,vd=root,srcip=10.100.1.121,srcport=55844,srcintf=port1,dstip=173.193.156.43,dstport=80,dstintf=port16,sessionid=1224203695,status=close
subtype=forward,level=notice,vd=root,srcip=10.100.1.121,srcport=55844,srcintf=port1,dstip=173.193.156.43,dstport=80,dstintf=port16,sessionid=1224203695,status=open 

This is the code I tried:

Pattern patt = Pattern.compile("(srcip=(?:\\d+\\.)+\\d+)(?:.*)?(dstip=(?:\\d+\\.)+\\d+)(?:.*)?(status=(?=.*close.*)(?:.*)?(dstport=(\\d+))");

BufferedReader r = new BufferedReader(new FileReader("ttext.txt"));

// For each line of input, try matching in it.
String line;
while ((line = r.readLine()) != null) {
  // For each match in the line, extract and print it.
  Matcher m = patt.matcher(line);
  while (m.find()) {
    // Simplest method:

    System.out.print(" " + m.group(1) + " " );
    System.out.print(" " + m.group(2) + " " );
System.out.print(" " + m.group(3) + " " );
System.out.println(" " + m.group(4));

The expected output was:

srcip=10.100.1.121 dstip=173.193.156.43 srcport=55844 status=close dstport=80  

But this is the output I get:

srcip=10.100.1.121  dstip=173.193.156.43  dstip=173.193.156.43  dstport=80
srcip=10.100.1.121  dstip=173.193.156.43  dstip=173.193.156.43  dstport=80

Any suggestions?

Answer 1

The order of your capturing groups doesn't correspond to the order of the fields in the input. Here is a re-ordered version of your regex that catches the 5 groups you need:

String s = "subtype=forward,level=notice,vd=root,srcip=10.100.1.121,srcport=55844,srcintf=port1,dstip=173.193.156.43,dstport=80,dstintf=port16,sessionid=1224203695,status=close";

Pattern p = Pattern.compile("(srcip=(?:\\d+\\.)+\\d+)(?:.*)?(srcport=(?:\\d+))(?:.*)?(dstip=(?:\\d+\\.)+\\d+)(?:.*)?(dstport=(?:\\d+))(?:.*)?(status=(?:.*))");
Matcher m = p.matcher(s);

if (m.find()) {
  System.out.println(m.group(1) + " " + m.group(3) + " " + m.group(2) + " " + m.group(5) + " " + m.group(4));
}

Note that I also fixed an unclosed group, and made one of the groups non capturing.