Regex parsing data from between <> PCRE -


i need parse asa logs , pull 2 fields, user , address field:

jan 21 11:03:31 vpn1.domain.com %asa-5-223065: group user ip <255.255.255.255> anyconnect parent session started.

jan 21 11:03:32 vpn1.domain.com %asa-3-844021: tunnelgroup grouppolicy user ip <255.255.255.255> no ipv6 address available svc connection

jan 21 11:03:32 vpn1.domain.com %asa-4-844044: group user ip <255.255.255.255> first tcp svc connection established svc session.

jan 21 11:03:32 vpn1.domain.com %asa-5-844025: group user ip <255.255.255.255> tcp svc connection established without compression

jan 21 11:03:32 vpn1.domain.com %asa-3-844049: group user ip <255.255.255.255> address <255.255.255.255> assigned session

i have this:

(user <([^>]*)>)|(address <(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)>) 

which gives me:

user <pp5678> , address <255.255.255.255> respectively 

how can modify give me pp5678 , 255.255.255.255 without field tags , "<>"?

you can use

(?<=user <)[^>]*|(?<=address <)(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) 

see demo

i put user < , address < positive lookbehinds. pcre supports lookbehinds of known (fixed) width.


Comments

Popular posts from this blog

php - Wordpress website dashboard page or post editor content is not showing but front end data is showing properly -

How to get the ip address of VM and use it to configure SSH connection dynamically in Ansible -

javascript - Get parameter of GET request -