Regex match groups lookback

Question

I'm trying to extract the same data (but in different "chunks" from a string several times. The use-case is parsing of Syslog messages from Fastly in Fluentd.

I have this log line:

2015-08-27T12:36:58Z cache-foo1234 Name[123456]: 4.151.22.16 "-" "-" POST /api/v1/foo/61ea23fb-53fb-4364-a892-349fdf5f6dca/event?release_type=store&version=2%2E0%2E1&os=ios&device_os_version=8%2E4&device_type=iphone 304 MISS BC942858-64FA-4101-BAE1-19272490697F iPhone 5S

and this regex (Ruby Regex) so far:

^(?<time>[^ ]*) (?<fastly_server>[^ ]*) (?<log_name>[^ ]*) (?<host>[^ ]*) (?<na>[^ ]*) (?<na2>[^ ]*) (?<http_method>[^ ]*) (?<http_request>[^ ]*) (?<http_status>[^ ]*) (?<cache_status>[^ ]*) (?<uuid>[^ ]*) *(?<device_model>.*)$

and this gives me:

• time 2015-08-27T12:36:58Z
• fastly_server cache-foo1234
• log_name Name[123456]:
• host 4.151.22.16
• http_method POST
• http_request /api/v1/foo/61ea23fb-53fb-4364-a892-349fdf5f6dca/event?release_type=store&version=2%2E0%2E1&os=ios&device_os_version=8%2E4&device_type=iphone
• http_status 304
• cache_status MISS
• uuid BC942858-64FA-4101-BAE1-19272490697F
• device_model iPhone 5S

and that is perfect, but how can I go back and extract ie. 61ea23fb-53fb-4364-a892-349fdf5f6dca , event and the value of device_os_version from the same string with the same regex?

Answer 1

Here is the updated regex:

^(?<time>[^ ]*) (?<fastly_server>[^ ]*) (?<log_name>[^ ]*) (?<host>[^ ]*) (?<na>[^ ]*) (?<na2>[^ ]*) (?<http_method>[^ ]*) (?<http_request>\/api\/v\d+\/foo\/(?<guid>[^\/]+)\/(?<event>[^\/?]+)[^ ]*device_os_version=(?<devosver>[^=&]+)[^ ]*) (?<http_status>[^ ]*) (?<cache_status>[^ ]*) (?<uuid>[^ ]*) *(?<device_model>.*)$

See demo

I just replaced your (?<http_request>) part to

(?<http_request>\/api\/v\d+\/foo\/(?<guid>[^\/]+)\/(?<event>[^\/?]+)[^ ]*device_os_version=(?<devosver>[^=&]+)[^ ]*)
                ^----------------^^-----GUID-------^^--event-------^     ^-------OS Version--------   -------^