Help with a regex


I have an event as follows:

Feb 23 15:42:39 {"protocol": {"protocol": "ip", "app": "http", "session_id": "CKFoMw2eSzfW8eTgNj", "event_status": "1", "headers_server": "AmazonS3", "transport": "TCP", "dest_port": "43940", "src_port": "8000", "event_id": "58af02768a20561313a6651b", "headers_user-agent": "EventMachine HttpClient", "headers_content-type": "application/octet-stream", "ftype": "gzip", "fname": "f8c860c2da4deae806e1939011f49c37e7feebc8", "sha256": "793dea4ef1ee24b4095ab9ee7a8cd896df26710650cb91a91423125fee960c17", "headers_uri": "/", "dest": "", "timestamp": "2017-02-23 15:40:38.911000", "host": "", "user": "UNKNOWN", "headers_host": "", "md5": "2f0467b1d2d304179f28cd7f0c17899c", "src": "", "dvc": "vna-bv-nw02i"}

Spunk support pointed out that this even it missing a trailing } . The regex I currently have working ^([^{]+)({.+})$ .

This gets me:

{"protocol": {"protocol": "ip", "app": "http", "session_id": "CKFoMw2eSzfW8eTgNj", "event_status": "1", "headers_server": "AmazonS3", "transport": "TCP", "dest_port": "43940", "src_port": "8000", "event_id": "58af02768a20561313a6651b", "headers_user-agent": "EventMachine HttpClient", "headers_content-type": "application/octet-stream", "ftype": "gzip", "fname": "f8c860c2da4deae806e1939011f49c37e7feebc8", "sha256": "793dea4ef1ee24b4095ab9ee7a8cd896df26710650cb91a91423125fee960c17", "headers_uri": "/", "dest": "", "timestamp": "2017-02-23 15:40:38.911000", "host": "", "user": "UNKNOWN", "headers_host": "", "md5": "2f0467b1d2d304179f28cd7f0c17899c", "src": "", "dvc": "vna-bv-nw02i"}

What I need to only get is:

{"protocol": "ip", "app": "http", "session_id": "CKFoMw2eSzfW8eTgNj", "event_status": "1", "headers_server": "AmazonS3", "transport": "TCP", "dest_port": "43940", "src_port": "8000", "event_id": "58af02768a20561313a6651b", "headers_user-agent": "EventMachine HttpClient", "headers_content-type": "application/octet-stream", "ftype": "gzip", "fname": "f8c860c2da4deae806e1939011f49c37e7feebc8", "sha256": "793dea4ef1ee24b4095ab9ee7a8cd896df26710650cb91a91423125fee960c17", "headers_uri": "/", "dest": "", "timestamp": "2017-02-23 15:40:38.911000", "host": "", "user": "UNKNOWN", "headers_host": "", "md5": "2f0467b1d2d304179f28cd7f0c17899c", "src": "", "dvc": "vna-bv-nw02i"}

Being a newb to regex, how do I do this?

Tags (1)
0 Karma

Esteemed Legend

I am assuming that you don't need the curly-braces either so use this:


If you really need the curly-braces, then do this:



Try this

0 Karma