Question

I am trying to parse a log file using regex, the problem is as soon as I turn on SingleLine mode so that I can include multi-line errors then future matches are included in the first match rather than their own.

To explain better, here is an example of a log file:

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

test

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

INFO 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

test 2

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

ERROR 16-08 11:09:59,015 – sdsdfsdfsdfsdfsdf

I am using the following regex:

.{5} \d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} - .+

This matches each line correctly but excludes the part of the message which has run onto a new line. But when I turn on singleline mode there is only one match (the first) and all the other entries are included in it.

Can anyone point me in the right direction?

Thanks 🙂

Answer 1

Basically the idea behind this solution is to tell your regex not what to include but where to stop.

This regex uses a positive lookahead to stop nongreedily at the next occurrence of your regex (or at the end of the whole string)

.{5} \d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} - .+?
     (?=(.{5} \d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})|\z)

This includes also the INFO line as part of the previous error message. It sounds a little buggy, so, in case you want to consider the INFO line as a single error message (not part of the previous one) you might consider using this regexp instead

.{4,5} \d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} - .+?
(?=.{4,5} \d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})