[Wellington-pm] lookahead/behind in regex

Richard Hector richard at walnut.gen.nz
Mon Oct 11 22:54:04 CDT 2004

On Tue, Oct 12, 2004 at 04:41:30PM +1300, michael at diaspora.gen.nz wrote:
> Richard Hector writes:
> >perl -p -e 's/^(?<=\[)(\d+)(?=\])/localtime($1)/e' < nagios.log
> This does, though:
>     perl -p -e 's/(?<=^\[)(\d+)(?=\])/localtime($1)/e' < nagios.log

Ah yes. It doesn't make much sense to have anything _before_ a
lookbehind (even if it is zero-width).

> If I was looking at that code later, though, I'd wonder why you didn't
> just do:
>     perl -pe 's/(\d+)/localtime $1/e' < nagios.log

Yes - I guess the timestamp will always be the first number. I get a bit
paranoid at times - partly I think from working with logcheck, which
filters log messages that can have damn near anything in them :-(

And that gets a bit closer to the pin :-)



More information about the Wellington-pm mailing list