Search code examples
regexpcre

RegEx for matching one to three words after a keyword

I have syslog like:

Apr 22 11:52:44 localhost systemd: Stopped logstash. 
Apr 22 11:52:07 localhost systemd: Started Getty on tty1. 
Apr 22 11:52:07 localhost systemd: Started Hostname Service. 
Apr 22 11:52:07 localhost systemd: Started Import network configuration from initramfs.

I wanna get 3 words after status (short program name).

My solution: 

"\bsystemd:\s+\S+\s\K\S+\s\S+\s\S+"

But, program name can be less than 3 words (like logstash in my log), thats why I need a regex to match 1 or 2 or 3 words depending on the length of the string.

How do I solve this problem?

Solution

  • You may use

    \bsystemd:\s+\S+\s\K\S+(?:\s\S+){0,2}

    See the regex demo.

    The \S+(?:\s\S+){0,2} part does the job: it matches 1+ non-whitespace chars followed with 0 to 2 repetitions of 1+ whitespaces followed with 1+ non-whitespace chars.

    See the regex graph:

    enter image description here

    enter image description here