I try to get a regex which returns the match in the first capture group.
The Application where I put the regex in can only use the first capture Group.
Each regex on it's own is working, but i can't combine these two in a way that the output is always in the first capture group
Input 1:
Event: Started Flapping
Regex 1:
^Event: (\S+ Flapping)
Output 1:
Started Flapping
Input 2:
Event: CRIT -> OK
Regex 2:
^Event:\s+\S+\s+\S+\s+(\S+)
Ouput 2:
OK
The Regex i tried
(?:^Event:\s+\S+\s+\S+\s+(?P<service>\S+)$|^Event: (?P<flap>Started Flapping)|((?P=service)|(?P=flap)))
You can use a branch reset group:
^Event:\s+(?|\S+\s+\S+\s+(\S+)|(Started Flapping))$
# or, to factor in \S+\s+:
^Event:\s+(?|(?:\S+\s+){2}(\S+)|(Started Flapping))$
See the regex demo. Details:
^ - start of stringEvent: - a fixed string\s+ - one or more whitespaces(?| - start of a branch reset group:
\S+\s+\S+\s+ - two occurrences of one or more non-whitespaces followed with one or more whitespaces(\S+) - Group 1: one or more non-whitespaces| - or
(Started Flapping) - Group 1: Started Flapping fixed string) - end of the branch reset group$ - end of string.