Regular Expression look ahead in log

Question

https://regex101.com/r/9kfa7D/4

I can never get the look ahead portion correct. I've tried a few different things, but I'm trying to get to the next date and parse it like that. Mainly because I don't know what the message will look like and it could be pretty random. Any help would be great.

I need to group the message portion of it.

Edit: Updated to make it a little more clear of what I'm trying to do. Never everything from each date.

Answer 1

You can just tweak your regex without tinkering lookahead like this:

^\d{2}-\w{3}-\d{4} (?:\d{2}:){2}\d{2}\.\d{3}

Updated Regex Demo

---

EDIT:

As per updated question OP can use this negative lookahead based regex to capture log text:

^[^\[]+\[[^\]]+\] +[^:]+ +(.*(?:\n(?!\d{2}-[a-zA-Z]{3}-).*)*)

This regex doesn't use DOTALL flag by unrolling the loop in last segment. This makes above regex pretty fast to complete the parsing.

New Demo

Answer 2

^(?:\\d{2}-\\w{3}-\\d{4} (?:\\d{2}:){2}\\d{2}\\.\\d{3}) ((?:[^\\n]+(?:\\n+(?!\\d{2}-\\w{3}-\\d{4})|))+)

The first part is the date pattern, which is non-grouping since you do not want to keep the date.

The second part is [^\\n]+ which is followed by a \\n provided it is not followed by \\d{2}-\\w{3}-\\d{4} (hence the negative look ahead).

The second part is then repeated any number of times.

You can see the demo on regex101 .

Answer 3

如果您关心日志时间戳记之间的消息，请使用此消息（在第二组中）：

/(\\d{2}-\\w{3}-\\d{4} \\S+ \\S+ \\[[^\\]]++\\] )(?=(.+)((?1)|\\z))/gms

Answer 4

What you need
(^\\d+.[AZ].*?)[AZ]

how it works
Lots of people like the complex thinking when they are confront a regex. But you should know exactly what you want.

you just need to match this: 29-Jun-2016 09:33:43.565 INFO and nothing else. So let's begin:

First: two digit,
next: A word with capital letter
next: everything from this word to the next capitalize word
finish.

the main rule Non-greedy mantch: .*?

prove

---

NOTE
do you want to match from beginning to log
very easy just add .*?log at the end. that's it.

Do you ever pay attention to how many steps it take?

First of mine: 7952
Second of mine: 13751
Compare it with other

After putting the picture here. some guys update their regex. I do not want to argue . no problem. I just wanted to show it. Otherwise I can ( as you can ) makes it less by choice the specific pattern For example: ^\\d+-[A-Za-z]+-\\d+\\s\\d+:\\d+:\\d+\\.\\d+ Now 7952 become 3878

Do you want to learn how lock-head assertion works?
Very easy. The main concept is that (?=) is never matches anything. It only matches the position just one point before you want.
like:
^\\d+-[AZ].+(?=[AZ]+ ).
It still matches: 29-Jun-2016 09:33:43.565 INFO
Pay attention to . at the end. So here the look head assertion point to between F and O

If would like to match this 29-Jun-2016 09:33:43.565 then what can you do?
Think about this:
^\\d+-[A-Za-z].+(?=[\\d] ).
and figure out it by yourself.