Using SED: Find Regex > Replace With Match Groups

Question

So I'm trying to restructure an access log to a particular format, I've already managed it in grok but learning sed sounds very useful so please humour me:

So, using SED I'm trying to find:

(\d+\.\d+\.\d+\.\d+) - - \[(.*?)\] "(\w{3,4}) (\/.*?(\/|\.\w+)) (HTTP(S)?\/.*?)"(\d{3}) (\d+) "(.*?)" "(.*?)" "(.*?), (.*?)"(\[.*?\]) (\[.*?\])

And Replace with:

$12 - - [\2] "\3 \4" \8 \9 "$10" "$11"

Match in File(A) replaced lines sent to File(B)

I've tried:

sed -r -i 's/((\d+\.\d+\.\d+\.\d+) - - \[(.*?)\] "(\w{3,4}) (\/.*?(\/|\.\w+)) (HTTP(S)?\/.*?)"(\d{3}) (\d+) "(.*?)" "(.*?)" "(.*?), (.*?)"(\[.*?\]) (\[.*?\]))/$12 - - [\2] "\3 \4" \8 \9 "$10" "$11"/g;' fileA.txt > fileB.txt

To which it (GNU) throws the following error:

sed: -e expression #1, char 1: unknown command: `''

I'm afraid I'm totally new to sed so this is as far as my Googlefu has gotten me.

Input:

IPAddress1 - - [30/Mar/2017:11:33:55 +0100] "GET /image.jpg HTTP/1.1 "200 2607 "http://www.example.co.uk/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" "IPaddress2, IPAddress 3"[abc] [def]

Expected Output:

IPAddress2 - - [30/Mar/2017:11:33:55 +0100] "GET /image.jpg" 200 2607 "http://www.example.co.uk" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"

Thank you kindly.

Answer 1

You need to make same changes in our regex to run it with sed.

I recommend you to use the -r parameter to can use extended regex syntax , it is more easy for JavaScript|PHP|Java users.

Here is a little peace of your regex working:

echo \
'127.0.0.1 - - [30/Mar/2017:11:33:55 +0100] "GET /image.jpg HTTP/1.1 "200 2607 "http://www.example.co.uk/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" "IPaddress2, IPAddress 3"[abc] [def]' \
| sed -r 's/([0-9]+(\.[0-9]+)+) - - \[([0-9]+)\/([^\/]+)\/([0-9]+):/"\1", "\3", "\4", "\5"/g'

This example is not completed , it only for show you the correct syntax .