Regex search

[nkl0x55]

Hi, I tried different combination but was unable to get my commands working.

I am trying to extract all similar strings from a large archives of logs "field1\":\"1111111111111111\",\"field2\":\"2222222222222222\"

This is the command that I ran ugrep on Windows .\ugrep.exe -oirIz --sort=name --stats '{"field1":"[0-9]+","field2":"[0-9]+",' E:\Logs

Searched 2500 files in 1 directory in 51.9 seconds with 7 threads: 0 matching (0%)
The following pathname selections and search constraints were applied:
--decompress --zmax=1
--directories=recurse
--no-hidden (default)
--sort=name
Lines matched ignoring case if:
"{"field1":"[0-9]+","field2":"[0-9]+"," matches

[genivia-inc]

Hope this helps:

The files you're searching may have spacing that is not matched. A quick sanity check shows that the regex pattern is fine, but only when there is no extra spacing in the input:

To match spacing when present, use regex pattern \h* to match spaces and tabs, for example:

'"field1"\h*:\h*"[0-9]+"\h*,\h*"field2"\h*:\h*"[0-9]+'

Braces and brackets may be spaced as well. Newlines \n may also be present, which should be accounted for in the regex pattern.

[nkl0x55]

Hi,

Thank you for the reply.

Tried the suggestion but was not to get it to work.

I tried using EmEditor using the regex pattern ("field1\":\"\d{16})\",\"field2\":\"\d{16}\*" and it was able to extract the strings I needed.

How do I "translate" the regex pattern into something ugrep is able to work with? As the logs are in gz format. I would prefer a tool that can directly work with archive.

Thank you

[genivia-inc]

Not sure what you mean. The regex works fine with ugrep. Just make sure you use single '-quotes for the regex pattern and you don't need to escape " with \" when running the ug command in a shell e.g. in bash. For example, here I'm using echo to show that ug finds the full matching pattern as expected:

$ echo '"field1":"1111111111111111","field2":"2222222222222222"' | ug '"field1":"\d{16}","field2":"\d{16}"'
     1:	"field1":"1111111111111111","field2":"2222222222222222"

Note that your regex ("field1\":\"\d{16})\",\"field2\":\"\d{16}\*" has extra ( and ), why is that?