Another regex

[dbcase]

Hi,

I have this data

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/315568/network/instances/100876ffe9572a.0/functions/disarm HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "

10.210.192.5 - - [26/Sep/2017:19:59:59 -0400] "POST /rest/icontrol/sites/4793/network/instances/140024460000052928.10.0/functions/thermostatStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

6:59:59.000 PM

10.210.192.15 - - [26/Sep/2017:19:59:59 -0400] "GET /rest/icontrol/sites/4793/network/lights/getAllLightingStatus HTTP/1.1" 202 9 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60" "-" "-"

And I think I need to do a backwards match (unless there is a better way). I need to match

disarm in the first event
thermostatStatus in the second event
getAllLightingStatus in the third event

I'm ok with regex but trying to wrap my mind around how to search backwards throws me for a loop!

[DalJeanis · Accepted solution]

Nothing backwards about it. We want a chunk that occurs between a slash "/" and the letters " HTTP". We want to make sure not to match the space \s or any other slashes \/.

Thus, we create a character type that matches anything but slash or whitespace [^\/\s], and capture however many of them there are, (but minimum one +) between our endpoints.

   | rex "\/(?<mymatch>[^\/\s]+)\sHTTP"

Voila.

[dbcase]

wow, that is pretty slick

[DalJeanis]

@dbcase - It's all in learning how to look at it. Sometimes you just have to take three steps back. Sometimes you have to cross your eyes. Sometimes you have to get out a chainsaw and cut a wall out of the way. 😉

[dbcase]

I can't wait to use the chainsaw! 🙂