Question

我的日志文件中有许多字符串，我希望通过regexp过滤：

Oct 21 08:05:27 ph10001019 phs: got valid password for flat 200
Oct 21 08:07:34 ph10001014 phs: got valid password for flat 200
Oct 21 08:08:05 ph10001014 phs: got valid password for flat 200
Oct 21 08:19:25 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:22:13 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:24:12 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:26:41 ph10001014 phs: got valid password for flat 200: 0034

此正则表达式返回我需要的字符串：

phs:\sgot\svalid\spassword.*200:\s0034

那很好，但我有两个最后一个数字的变种。我尝试了下面的正则表达式，但它返回空字符串。

phs:\sgot\svalid\spassword.*200:\s(0034)|(4321)

第二个regexp出了什么问题？

Answer 1

phs:\sgot\svalid\spassword.*200(?::\s(?:0034|1234))?

试试这个。这应该会给你你的结果。见演示。

http://regex101.com/r/rQ6mK9/12

Answer 2

我认为你只想匹配最后一个字符串。避免使用\s来匹配空格，因为\s也会匹配换行符。

phs:\h+got\h+valid\h+password.*?200:\h+(?:0034|4321)

DEMO

$data = <<< EOT
Oct 21 08:05:27 ph10001019 phs: got valid password for flat 200
Oct 21 08:07:34 ph10001014 phs: got valid password for flat 200
Oct 21 08:08:05 ph10001014 phs: got valid password for flat 200
Oct 21 08:19:25 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:22:13 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:24:12 ph10001019 phs: got valid password for flat 200: 1234
Oct 21 08:26:41 ph10001014 phs: got valid password for flat 200: 0034
EOT;
preg_match_all('~phs:\h+got\h+valid\h+password.*?200:\h+(?:0034|4321)~', $data, $match);
print_r($match);

<强>输出：

Array
(
    [0] => Array
        (
            [0] => phs: got valid password for flat 200: 0034
        )

)

简单或正则表达

2 个答案: