I'm new to regex expressions and I need some help to capture only lines that have the (-999), and retrieve the number in parentheses in a line like "2016/99/99 12:00:0.999 2 1 (-499) Cannot open the message store with error code" This is for an ITM log monitor for Tivoli.
Asked
Active
Viewed 63 times
-3
-
3Have you tried anything? What works and what does not work? – Wiktor Stribiżew Sep 13 '16 at 12:41
-
I have tried: REGEX error_log ^$"\([^\d]*(\d+)[^\d]*\)"$ timestamp $1 CustomSlot1 evtcategory $2 CustomSlot2 severity "Error" CustomSlot3 msg $7 END – J Cromwell Sep 13 '16 at 12:50
-
Please add that to the question. – Wiktor Stribiżew Sep 13 '16 at 12:53
1 Answers
0
Would be nice if you had tried something yourself.. but anyway try this: \((-.*?)\)
This will capture anything negative that is between the brackets.
You never specified what language you were using, some languages use different regex engines and may or may not require delimiters - so this is a bit of a shot in the dark.
DNKROZ
- 2,634
- 4
- 25
- 43
-
Thanx, I have been to that site a few times over the last few days, trying various things. I have been able to get the part I'm looking for highlighted, but them I try it in the .fmt file, it shows syntax error, so I missing something – J Cromwell Sep 13 '16 at 13:03
-
I'm not sure about .fmt files. But maybe you're missing the delimeters? try `/\((-.*?)\)/g` – DNKROZ Sep 13 '16 at 14:44