How to capture strings between time stamps with python? - regex

Question

I have paragraphs like below
Dec 27 09:00:06 test event[1] number one
Dec 30 02:00:06 here is event[22] Feb 01 04:36:11 helloworld2
Dec 07 04:00:11 Now is event{3} Jan 01 04:36:11 Helloworld
Jan 02 23:00:11 helloworld evnt{45}
Feb 12 04:36:11 mesg10 Feb 13 04:36:11 mesg11 Feb 14 04:36:11 testmesg12
I want to capture the time stamp and message that occurred on that time stamp
Im using pythex.org to test the python regex (?P\w{3}\s\w{2}\s\w{2}:\w{2}:\w{2})\b(?P.*)
but this is only working for line separated and fails on paragraph having multiple(1+) Timestamps and message on same line. For example in above paragraphs I cannot capture Timestamp and message on Feb 12 04:36:11 mesg10 Feb 13 04:36:11 mesg11 Feb 14 04:36:11 testmesg12

Answer 1

Here is a 2.x Python solution which uses findall to find multiple matches in each line of your log file:
import re
p_str = '\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s(.*?)(?=\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s|$)'
pattern = re.compile(p_str, re.IGNORECASE)
log_str = 'Feb 12 04:36:11 mesg10 Feb 13 04:36:11 mesg11 Feb 14 04:36:11 testmesg12'
match = pattern.findall(log_str)
print match
['mesg10 ', 'mesg11 ', 'testmesg12']
Demo
The challenge here is in formulating a pattern which will work. I went the route of matching a timestamp, and then using a lookahead to know when to stop matching. We stop matching when we either see another timestamp, or we see the end of the line. Note that matching the next timestamp won't work here, because we need that to be the start of the next match as the regex works its way across the line.
Explore the demo to see the code in action.