DX Infrastructure Manager

Expand all | Collapse all

Negative LookAhead regex in logmon

Jump to Best Answer
  • 1.  Negative LookAhead regex in logmon

    Posted 06-26-2018 08:46 AM

    Can someone share some example of Negative Look Ahead Regex being used in Logmon.



  • 2.  Re: Negative LookAhead regex in logmon

    Broadcom Employee
    Posted 06-26-2018 08:56 AM

    I am not sure I have ever seen any examples if these in a support case as usually doing not present regex can cause performance issues.

     

    There are many examples of what you are looking for out on the net though.

    regex - Regular expression negative lookahead - Stack Overflow 

    Negative Lookahead - Regex Tester/Debugger 

     

    hope this helps



  • 3.  Re: Negative LookAhead regex in logmon

    Posted 06-26-2018 03:47 PM

    There's a nice set of performance tweaks at https://www.loggly.com/blog/five-invaluable-techniques-to-improve-regex-performance/  and Regex Tutorial—From Regex 101 to Advanced Regex 

     

    Like most performance comments it depends on the data and the attention paid to how the language being written in evaluates things. 

     

    You can write things in negative lookaheads that can't be easily phrased otherwise and so perhaps the slower single regex might be much faster than the multiple steps necessary to simulate.

     

    -Garin



  • 4.  Re: Negative LookAhead regex in logmon
    Best Answer

    Posted 06-26-2018 09:00 AM

    Assume you have a log file with criticalities associated with them: INFO, ERROR, CRITICAL, etc.

     

    You want all log lines except INFO.

     

    You could use a filter like is explained at:

    regex - Regular expression to match a line that doesn't contain a word? - Stack Overflow 

     

    ^((?!INFO).)*$

    Saves you from having to know what to include.

     

    Alternatively what if you need to match a log line with words in it but they could be any order:

    Regex to match string containing two names in any order - Stack Overflow 

     

    ^(?=.*\bERROR\b)(?=.*\bCRITICAL\b).*$

     

    -Garin