Regex select between nth special character and a string

user_9742446 0
Viewed 104

I have an ESXi host that failed and I am trying to grep the guests that might have been running on the host at the time of failure.

I found some logs where the VM failed to load after we've powered back on the ESXi host, this could possibly give me the information I am looking for, however, I am only interested in the VM name and compiling it into a list.

One section of the log reads as:

2021-09-06T13:33:01.272Z info hostd[2101147] [Originator@6876 sub=Vmsvc.vm:/vmfs/volumes/5c0ae3ca-926257bb-d4dc-1234567e66bc/VMNAME/VMNAME.vmx] Failed to load virtual machine: N3Vim5Fault12FileNotFound9ExceptionE(Fault cause: vim.fault.FileNotFound

My end goal would be to grab "VMNAME" where this would be the names of all the virtual machine as there are several entries all with different names of course. Below is what I have so far, except I would like to select the 5th /

(?=\/).*(?=.vmx)

However, the above pattern returns no results, may be a limitation of ESXi, below is what I'm using to find the logs I need.

grep -E "vim.fault" hostd.log

If I have to paste the results of grep into np++ for a proper regex then that is fine also. Any of your assistance would be greatly appreciated.

esxi grep regex
1 Answers

POSIX ERE does not support lookarounds.

You can use

grep -oE '[^][/]+\.vmx' hostd.log

Here, o option makes grep extract matches, E enables the POSIX ERE syntax and the [^][/]+\.vmx regex matches one or more chars other than ], [ and / and then .vmx substring.

Or, alternatively, sed like

sed -nE 's,.*/([^][/]+\.vmx).*,\1,p' hostd.log

Here,

  • -nE - n option suppresses the default line output and E enables the POSIX ERE syntax
  • s,.*/([^][/]+\.vmx).*,\1,p - substitution command that finds
    • .* - any text
    • / - / char
    • ([^][/]+\.vmx) - Group 1: one or more chars other than [, ] and / and then .vmx
    • .* - any text
  • \1 - replaces the match (the whole string) with Group 1 value
  • p - only prints the result of the replacement.
user_38329700
Related