regexprtg

Is it possible to find a match on last occurence between two words with regex?


I have a text log file that look like this:

    --Start 10:00:00
    --Success
    --End 10:01:02

    --Start 10:02:32
    --Success
    --End 10:02:40
    
    --Start 10:02:00
    --Error
    --End 10:02:05

The last block is the last registered event. Is there a way to match a regex ONLY when in the last block "error" shows up?

I tried something like ((?=Start)(*.)(?=Error)(*.)(?=End))(?:.(?!\\)) but does not work. I am not a regex expert.

I am trying to use it on PRTG to monitoring a service.

Really appreciate your help, thanks.


Solution

  • Reading this page https://www.paessler.com/manuals/prtg/regular_expressions the supported regex engine is PCRE.

    You could match the block that contains Error while asserting that at the end, there is no part following that starts with --Start

    ^\h*--Start .*\R\h*--Error\R\h*--End\b.*$(?!\R\s*--Start\b)
    

    Explanation

    See a regex demo