Regex parsing data from between <> PCRE -
i need parse asa logs , pull 2 fields, user , address field:
jan 21 11:03:31 vpn1.domain.com %asa-5-223065: group user ip <255.255.255.255> anyconnect parent session started.
jan 21 11:03:32 vpn1.domain.com %asa-3-844021: tunnelgroup grouppolicy user ip <255.255.255.255> no ipv6 address available svc connection
jan 21 11:03:32 vpn1.domain.com %asa-4-844044: group user ip <255.255.255.255> first tcp svc connection established svc session.
jan 21 11:03:32 vpn1.domain.com %asa-5-844025: group user ip <255.255.255.255> tcp svc connection established without compression
jan 21 11:03:32 vpn1.domain.com %asa-3-844049: group user ip <255.255.255.255> address <255.255.255.255> assigned session
i have this:
(user <([^>]*)>)|(address <(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)>)
which gives me:
user <pp5678> , address <255.255.255.255> respectively
how can modify give me pp5678 , 255.255.255.255 without field tags , "<>"?
you can use
(?<=user <)[^>]*|(?<=address <)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
see demo
i put user <
, address <
positive lookbehinds. pcre supports lookbehinds of known (fixed) width.
Comments
Post a Comment