Regex : how to combine lookahead for following purpose?

[axl88]

I am trying to clean log files to categorize them in Splunk, so my question is:

(?i)^(?:[^ ]* ){8} ((?P.+) ((?=\d{8}\d{8}\d{10}.)|(?=\d{8}.?))

bold area needs to be combined like if/else,[it selects good before bold lines]

I want it to STOP just before just-8 digits and dot (dddddddd.) OR 8digit_8digit_10digits (8xd_8xd_10xd.)

my task is to get rid of all unique numbers on log file that i can categorize it better.

please help,

[theunf]

My client needs to index MQ messages that have a variable payload from 1000 to 450k characters 😉

Does the transforms´ lookahead supports an unlimited value, like 0 or -1 ?

[axl88 · Accepted solution]

(?=\d{8}(?:_\d{8}_\d{10})?\.?) 

this satisfies my conditions above. I just need little more to add this personally.

[axl88]

(?=\d{8}(?:\d{8}\d{10})?.) this satisfies my conditions above. I just need little more to add this personally.

[martin_mueller]

Okay, something like this?

(?i)Message:\s*(?<message>.*?)\s*[0-9_.]{8,}

[axl88]

numbers could be at any place. @martin

[martin_mueller]

Are you possibly looking for something like this?

(?i)Message:\s*(?<message>.*?)\s*[0-9_.]*$

[axl88]

input of first two lines , would be those two line outputs. Like I said, I m trying to generalize log messages via Regex to have something to monitor overall at the end.

[axl88]

Input:
Timestamp: 2/26/2014 4:00:42 PM SN #7 Message: ServerXYZ: AppXYZ failed to grab activity code for response 12345678. Timestamp: 2/26/2014 3:37:42 PM SN #31 Message: Error copying folders, the following exception was thrown IOException: The process cannot access the file 12345678_12345678_1234567890'
Output: should refer to
AppXYZ failed to grab activity code for response
Error copying folders, the following exception was thrown IOException: The process cannot access the file
I desire no unique number fields,I can do some stats like what type of error I have on my site.

[lukejadamec]

It is not clear what you're trying to do.

The fieldname will not be variable. You might be better off with sed.
Can you post some actual examples?