comma separate syslog regex


First of all im completely new to the whole regex world:)

I have a syslog line comma separated and i want a regex pattern which for example will extract everything after the 18th comma until the 19th comma:

Jul 22 17:36:52 filterlog: 115,16777216,,1433788744,enc0,match,pass,in,4,0x0,,254,15282,0,none,1,icmp,60,,,request,6546,820140

its(my app) using java-based regex

Hans de JonghAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Why not just split the string at the comma and get item[17] (the eighteenth element) from the resulting array?
String string = "Jul 22 17:36:52 filterlog: 115,16777216,,1433788744,enc0,match,pass,in,4,0x0,,254,15282,0,none,1,icmp,60,,,request,6546,820140";
String[] item = string.split(",");

//item[17] should have what you need

Open in new window

Hans de JonghAuthor Commented:
It seems you are interested in the first IP address.  Try:

In the actual java code, you would need to escape the backslashes, so if the above doesn't work, try:
Python 3 Fundamentals

This course will teach participants about installing and configuring Python, syntax, importing, statements, types, strings, booleans, files, lists, tuples, comprehensions, functions, and classes.

Hans de JonghAuthor Commented:
no im also interested i the second IP, and the ports and the interface and the rule number and if its in or out and if its blocked or passed
and so on... that why i need to be able to say get the chars after this amount of comma's
please state your requirements clearly.

In your original post I can see
for example will extract everything after the 18th comma until the 19th comma:

In a subsequent post you state
i need to be able to say get the chars after this amount of comma's

In another post you state
i don't think that is possible in vmware log insight
Can you explain why not?
Hans de JonghAuthor Commented:
i need a regex which in which i can say after you came a cross x amount of comma's (no matter if it were ,,, or ,1234,12345,123,) give me everything after that comma until the next comma.

In vmware log insight i can extract field. The field extraction is done for me, i just need to tell log insight where it is in the text

the problem is the only consistent thing is the number of "," in front of it.

see the attachment.
so it is about the pre and post context
OK, that helps.  Under "Pre and Post context" try the following for the top textbox (the pre-context):

Open in new window

It should capture:
Jul 22 17:36:52 filterlog: 115,16777216,,1433788744,enc0,

 then to extract whatever follows "enc0," (in this example "match", then enter:

Open in new window

in "Extracted Value" textbox.  Play with the 5 in the regex to skip to other columns.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Hans de JonghAuthor Commented:
thanks a lot, I have one more question.
(?:[^,]*,){8} after the 8th comma there will always be a 4 or a 6.
is it possible to only get lines where there is a 4 after the 8th comma.
Using the example input string you provided, if you enter the following in the Pre-Context box:

and then:
In the Extracted Value box, then it should capture "0x0" (again, I am using the example string you posted.  If the sample string had a 6 instead of a 4, then it wouldn't match that row.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Regular Expressions

From novice to tech pro — start learning today.