Search code examples
regexprtg

Is it possible to find a match on last occurence between two words with regex?


I have a text log file that look like this:

    --Start 10:00:00
    --Success
    --End 10:01:02

    --Start 10:02:32
    --Success
    --End 10:02:40
    
    --Start 10:02:00
    --Error
    --End 10:02:05

The last block is the last registered event. Is there a way to match a regex ONLY when in the last block "error" shows up?

I tried something like ((?=Start)(*.)(?=Error)(*.)(?=End))(?:.(?!\\)) but does not work. I am not a regex expert.

I am trying to use it on PRTG to monitoring a service.

Really appreciate your help, thanks.


Solution

  • Reading this page https://www.paessler.com/manuals/prtg/regular_expressions the supported regex engine is PCRE.

    You could match the block that contains Error while asserting that at the end, there is no part following that starts with --Start

    ^\h*--Start .*\R\h*--Error\R\h*--End\b.*$(?!\R\s*--Start\b)
    

    Explanation

    • ^ Start of string
    • \h*--Start .*\R Match the line with start followed by a newline
    • \h*--Error\R Match the line with Error followed by a newline
    • \h*--End\b.*$ Match the line with End until the end of the string
    • (?!\R\s*--Start\b) Negative lookahead, match a newline and assert that there is not a first line following that starts with --Start

    See a regex demo