How to get negative lookahead in regex to accept more words

Question

I am trying to get some data for Splunk.

From this:

this my line - Fine (R/S)
more date - I like this (not)
date - output (yes)

I like to get all data from - to the end of line, but not the data in parentheses if it contains not or yes, so data in group1 should be:

Fine (R/S)
I like this
output

I have tried some like this:

- (.+) (?!(not|yes))

But this gives:

Fine
I like this
output

Or This:

- (.+)(?!not)

Gives:

Fine (R/S)
I like this (not)
output (yes)

Avinash Raj · Accepted Answer · 2015-06-23T11:12:22.453

3

You may try this,

- ((?:(?!\((?:not|yes)\)).)*)(?=\s|$)

or

- (.*?)(?=\s+\((?:not|yes)\)|$)

This would capture all the chars until a space(yes) or space(no) or end of the line is reached.

edited Jun 23 '15 at 11:12

answered Jun 23 '15 at 11:01

Avinash Raj

Why `-.*(?!not)` doesn't work? (If I want to match everything not followed by "not", for example). – Maroun Jun 23 '15 at 11:03
1

Because `-.*(?!not)` matches the whole line until the last. At the last, there isn't a not string, so the above would provide a match. – Avinash Raj Jun 23 '15 at 11:04
So can you please explain what's the workaround you did? – Maroun Jun 23 '15 at 11:06
Thanks for quick response. I will test it out. – Jotne Jun 23 '15 at 11:06
Avinash: you may want to remove first regex as 2nd one is the right one meeting OP's requirement +1 – anubhava Jun 23 '15 at 11:08
a little change in the first one, `- ((?:(?!$(?:not|yes)$).)*)(?=\s|$)` – Avinash Raj Jun 23 '15 at 11:10
Thanks, both regex works, but I have to take some care to the `not`, it could be some like this `(real 22 ms)` so the I change `not` with `real[^)]+` to get all characters within the parentheses. – Jotne Jun 23 '15 at 11:25

1 Answers1