PCRE2 regular expression with optional ending character always matches the optional ending character

user_2635443 0
Viewed 125

I have a PCRE2 expression that reads a username from some logs. In the logs, the username might optionally be in brackets. I need to get the username via the regex, without the brackets of course.

Example logs:

msg_id="1100-0005" Authentication of Firewall user [someuser@somehost] from fe80::badd:cafe was rejected, password is incorrect
msg_id="5000-0001" WebUI User anotheruser@anotherhost from 10.0.0.2 log in attempt was rejected - invalid credentials.

The regex I came up with (where group 3 should be the username):

msg_id="[0-9a-fA-F]{4}-[0-9a-fA-F]{4}"\s(Authentication of)?\s?(.*\s[Uu]ser)\s\[?(\S+)\]?\s

So far, I get someuser@somehost] for the first log and anotheruser@anotherhost for the second log. Is there a way I can get rid of the ending bracket without using non-greedy option ?

pcre regex
1 Answers

You can use

msg_id="[0-9a-fA-F]{4}-[0-9a-fA-F]{4}"(?:\s+Authentication of)?\s+(.*?\s[Uu]ser)\s\[?([^\[\]\s]+)

See the regex demo. Details:

  • msg_id=" - a literal string
  • [0-9a-fA-F]{4} - four hex chars
  • - - a hyphen
  • [0-9a-fA-F]{4} - four hex chars
  • " - a " char
  • (?:\s+Authentication of)? - an optional sequence of one or more whitespaces and then Authentication of string
  • \s+ - one or more whitespaces
  • (.*?\s[Uu]ser) - Group 1: zero or more chars other than line break chars as few as possible, and then a whitespace and User or user
  • \s - a whitespace
  • \[? - an optional [ char
  • ([^\[\]\s]+) - Group 2: one or more chars other than ], [ and whitespace.
user_38329700
Related