[Wellington-pm] lookahead/behind in regex
Richard Hector
richard at walnut.gen.nz
Mon Oct 11 22:54:04 CDT 2004
On Tue, Oct 12, 2004 at 04:41:30PM +1300, michael at diaspora.gen.nz wrote:
> Richard Hector writes:
> >perl -p -e 's/^(?<=\[)(\d+)(?=\])/localtime($1)/e' < nagios.log
>
> This does, though:
>
> perl -p -e 's/(?<=^\[)(\d+)(?=\])/localtime($1)/e' < nagios.log
Ah yes. It doesn't make much sense to have anything _before_ a
lookbehind (even if it is zero-width).
> If I was looking at that code later, though, I'd wonder why you didn't
> just do:
>
> perl -pe 's/(\d+)/localtime $1/e' < nagios.log
Yes - I guess the timestamp will always be the first number. I get a bit
paranoid at times - partly I think from working with logcheck, which
filters log messages that can have damn near anything in them :-(
And that gets a bit closer to the pin :-)
Thanks,
Richard
More information about the Wellington-pm
mailing list