Help with improving Regex

[youngsuh]

Here is the regex to extract message_type based on CIM.  Could anyone make this faster than 1387 steps?

https://regex101.com/r/dHbs4i/1

(?P<message_type>[^.]query|response)\:

Here is the sample syslog for DNS.

Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 26818 from 10.130.27.34#13258: view none: query: a-grv-gocdzace.g.ae3.dns.mil IN A + (10.130.44.87%0)
Feb  3 00:42:32 FSTAd2346.g.ae3.dns.mil tmm[19902] 2021-02-03 00:42:32 FSTAd2346.g.ae3.dns.mil qid 57035 to 10.130.27.34#13258: [NOERROR qr,aa,rd] response: a-grv-gocdzace.g.ae3.dns.mil

[bowesmana]

Unless you really need to have the [\.] in the regex, i.e. you want to match any character in front of the word query, other than the '.' character and to include this in your message type then you should use one of the suggestions.

NB, you don't need the \ in front of :

[manjunathmeti · Accepted solution]

This executes with 50 steps with the given sample data.

(?<message_type>query|response)\:

[scelikok]

Hi @youngsuh,

Below is working in 163 steps based on your sample data. 

\s(?P<message_type>query|response)\: