0

I have following string :

Jul 20 16:47:43 chefawsdeveastbck2 dhclient[1036]: bound to 10.205.5.122 -- renewal in 1797 seconds.
Jul 17 18:07:15 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) Sending gratuitous ARPs on eth0 for 10.205.5.121
Jul 17 18:07:10 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) Sending gratuitous ARPs on eth0 for 10.205.5.121
Jul 17 18:07:10 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) setting protocol VIPs.
Jul 17 18:07:10 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) Entering MASTER STATE
Jul 17 18:07:09 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) Transition to MASTER STATE
Jul 17 18:07:09 chefawsdeveastbck2 Keepalived_vrrp[937]: VRRP_Instance(PC_VI) Transition to Backup STATE

I only need to extract "MASTER STATE" , "backup STATE", "Backup STATE" from the above strings , which will always appear after "VRRP_Instance(PC_VI) Entering" or "VRRP_Instance(PC_VI) Transition to". Right now , i have wrote the following:

.*(VRRP_Instance.*.[EnteringTransitionto]+ )(?P<instance_state>.+)

It obviously is not right and picking up other strings as well. Please help.

4
  • Just to clarify, the block of text -- is each line a separate string, or is the entire block one string? Commented Jul 20, 2015 at 20:54
  • Yes , each line is a separated string. Commented Jul 20, 2015 at 20:54
  • What language/tool are you using and what's your expected output? Commented Jul 20, 2015 at 21:09
  • I want to assign the value "MASTER STATE" and "Backup STATE" to a variable instance_state , for their respective lines . I am using Splunk tool. Commented Jul 20, 2015 at 21:11

3 Answers 3

1

You just need to use alternation to find your two possible key strings instead of trying to match any of the individual letters in them.

For example:

.*VRRP_Instance.*.(Entering|Transition to) (?P<instance_state>.+
Sign up to request clarification or add additional context in comments.

Comments

1

If Master and Backup states are the only states you have then you can use regex like this ((?:\bMASTER\b|\bBACKUP\b) STATE)$ with Multiline (m), Ignore case (i) and Global (g) modifiers.

Comments

1
/VRRP_Instance\(PC_VI\) (?:Entering|Transition to) ((?:MASTER|[bB]ackup) STATE)/

regexper diagram

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.