View previous topic :: View next topic |
Author |
Message |
toralf Developer
Joined: 01 Feb 2004 Posts: 3922 Location: Hamburg
|
Posted: Sat Apr 08, 2017 3:02 pm Post subject: [solved] grep "this but not followed by one of these&qu |
|
|
I'd like to ask for a single grep pattern which satisfies the condition to grep for all lines in a file containing string "foo" , if "foo" is not followed by "bar" or "bla".
So this should match : "prefix foo mampf postfix", but this not : "prefix foo bar postfix"
Last edited by toralf on Sat Apr 08, 2017 3:26 pm; edited 1 time in total |
|
Back to top |
|
|
John R. Graham Administrator
Joined: 08 Mar 2005 Posts: 10589 Location: Somewhere over Atlanta, Georgia
|
Posted: Sat Apr 08, 2017 3:25 pm Post subject: |
|
|
Build grep with the pcre USE flag as you need the "negative lookahead" feature it provides. Then your regex is straightforward: Code: | grep -P 'foo (?!bar|bla)' | - John _________________ I can confirm that I have received between 0 and 499 National Security Letters. |
|
Back to top |
|
|
toralf Developer
Joined: 01 Feb 2004 Posts: 3922 Location: Hamburg
|
Posted: Sat Apr 08, 2017 3:26 pm Post subject: |
|
|
John R. Graham wrote: | Build grep with the pcre USE flag as you need the "negative lookahead" feature it provides. Then your regex is straightforward: Code: | grep -P 'foo (?!bar|bla)' | - John | yep - thx |
|
Back to top |
|
|
khayyam Watchman
Joined: 07 Jun 2012 Posts: 6227 Location: Room 101
|
Posted: Sat Apr 08, 2017 3:26 pm Post subject: |
|
|
toralf ...
Code: | % cat input
prefix foo mampf postfix
prefix foo bar postfix
% grep -P 'foo.(?!bar)' input
prefix foo mampf postfix |
edit ... JRG beat me to it ... damn ;)
HTH & best ... khay |
|
Back to top |
|
|
John R. Graham Administrator
Joined: 08 Mar 2005 Posts: 10589 Location: Somewhere over Atlanta, Georgia
|
Posted: Sat Apr 08, 2017 3:39 pm Post subject: |
|
|
Two problems with my regex:- It doesn't match foo at the end of a line.
- It doesn't take into account the possibility of non-space whitespace.
Solutions left as an exercise.
- John _________________ I can confirm that I have received between 0 and 499 National Security Letters. |
|
Back to top |
|
|
toralf Developer
Joined: 01 Feb 2004 Posts: 3922 Location: Hamburg
|
Posted: Sat Apr 08, 2017 3:55 pm Post subject: |
|
|
Hhm, so this is not the solution till now : Code: | ssh2: (?!ED25519 SHA256:H7Rl8OShjUdLmaItsuIBt6sg44mhm6WLpXDoAAGVYck|ECDSA SHA256:vBwUgxXc/004y1INvwPxFtAP5CgHpJ1C2BEg2KRVnUo)
| at least Code: | grep -P -f watch-auth.txt /var/log/auth.log | doesn't spew out all other successful attempts. |
|
Back to top |
|
|
John R. Graham Administrator
Joined: 08 Mar 2005 Posts: 10589 Location: Somewhere over Atlanta, Georgia
|
Posted: Sat Apr 08, 2017 5:27 pm Post subject: |
|
|
You have an unescaped slash in that string. Take care with your escaping of characters that might have meaning in a regex context.
- John _________________ I can confirm that I have received between 0 and 499 National Security Letters. |
|
Back to top |
|
|
|