Grep magic

I have this wonder in my logs:

FROM='Mr. Void <[email protected]>'|||ENV_FROM='<[email protected]>'

And this is my parser:

grep -oP "(?<=FROM=\').*?(?=\')"

It does work by bringing me both FROM and ENV_FROM. This is bad. I want EXACT match. Is it possible with lookbehind and lookahead?

Comments

  • MasonMason AdministratorOG

    @legendary said: This is bad. I want EXACT match.

    Is the "FROM" that you're after always at the start of a new line? If so, just change it to:

    grep -oP "(?<=^FROM=\').*?(?=\')"

    and it won't pick up the "ENV_FROM".

    Thanked by (2)Falzo legendary

    Head Janitor @ LES • AboutRulesSupportDonate

  • Does: grep -oP "(?<=\bFROM=\').*?(?=\')" solve it for you? (I added \b before FROM to signify word boundary and it worked as I think how you'd like it to work - i.e only match FROM and not ENV_FROM).

    Here's a sample test case from me:

    (the first one is with a capital - not what you want, and the second one is with a lower case - I think what you want).

    echo "foo FROM='from_address' bar ENV_FROM='env_from_address' junk suffix\nFROM='Mr. Void <[email protected]>'|||ENV_FROM='<[email protected]>'\nfoo ENV_FROM='hello_how_are_you' bar FROM='howdy' baz" | grep -oP "(?<=\BFROM=\').*?(?=\')"
    
    

    gives me:

    env_from_address
    <[email protected]>
    hello_how_are_you
    

    And what I think you want is:

    echo "foo FROM='from_address' bar ENV_FROM='env_from_address' junk suffix\nFROM='Mr. Void <[email protected]>'|||ENV_FROM='<[email protected]>'\nfoo ENV_FROM='hello_how_are_you' bar FROM='howdy' baz" | grep -oP "(?<=\bFROM=\').*?(?=\')"
    
    

    gives me:

    from_address
    Mr. Void <[email protected]>
    howdy
    
    Thanked by (3)Mason Falzo legendary
  • @nullnothere said:
    Does: grep -oP "(?<=\bFROM=\').*?(?=\')" solve it for you? (I added \b before FROM to signify word boundary and it worked as I think how you'd like it to work - i.e only match FROM and not ENV_FROM).

    Here's a sample test case from me:

    (the first one is with a capital - not what you want, and the second one is with a lower case - I think what you want).

    echo "foo FROM='from_address' bar ENV_FROM='env_from_address' junk suffix\nFROM='Mr. Void <[email protected]>'|||ENV_FROM='<[email protected]>'\nfoo ENV_FROM='hello_how_are_you' bar FROM='howdy' baz" | grep -oP "(?<=\BFROM=\').*?(?=\')"
    
    

    gives me:

    env_from_address
    <[email protected]>
    hello_how_are_you
    

    And what I think you want is:

    echo "foo FROM='from_address' bar ENV_FROM='env_from_address' junk suffix\nFROM='Mr. Void <[email protected]>'|||ENV_FROM='<[email protected]>'\nfoo ENV_FROM='hello_how_are_you' bar FROM='howdy' baz" | grep -oP "(?<=\bFROM=\').*?(?=\')"
    
    

    gives me:

    from_address
    Mr. Void <[email protected]>
    howdy
    

    Yes, \b did the trick. Thank you for your time and effort. Greatly appreciated.

Sign In or Register to comment.