How do you reject a string if preceded by another string using standard POSIX regex?

Question

I have a regex which finds errors in a log for me:

/(exception|error)/i

This works, except that I do not want to be alerted when the following occurs, which I expect to happen:

DD/MM/YYYY 10:20pm: Read exception encountered

How do I specifically reject the 'Read exception encountered' string? I'm trying to use the ?! operator, but failing:

/(?!Read exception encountered)(exception|error)/i

The above still matches the string I want to exclude.

UPDATE: After experimenting with the negative lookbehind and lookahead solutions below, I have discovered that SiteScope supports only basic POSIX regex features, not extended features. Is a solution possible using only basic POSIX regex features?

I'm not sure. I'm using SiteScope. Standard Regex? – David Smith Jul 11 '13 at 18:29 — David Smith, Jul 11 '13 at 18:29

score 4 · Accepted Answer · answered Jul 11 '13 at 18:34

4

You want to use "Negative Lookbehind" (if it's supported by your regex engine.) effectively you say "I want to match X patern, as long as this other pattern does NOT preceed it."

In your example, it looks like this:

/(?<!read )(exception|error)/i

see more about "lookaround" features here.

answered Jul 11 '13 at 18:34

Robert P

15,707
10
68
112

The expression `(?<!read )(exception|error)` could get hung up on possible edge cases like `Thread exception while running report` – Ro Yo Mi Jul 11 '13 at 20:36
It appears that SiteScope does not support Negative Lookbehind, but still +1 for your assistance - this is a likely solution for others who find this question. – David Smith Jul 11 '13 at 21:18

Ro Yo Mi · Answer 2 · 2013-07-11T20:40:48.273

1

If you're looking to reject the entire string if the sub-string Read exception encountered is in the string, then I would simply use a negative look ahead which is supported by most languages.

^(?![^\r\n]*?\bRead exception encountered\b)[^\r\n]*?(exception|error)

Live example: http://www.rubular.com/r/CV7P9huVsI

enter image description here

edited Jul 11 '13 at 20:40

answered Jul 11 '13 at 20:30

Ro Yo Mi

14,790
5
35
43

score 1 · Answer 3 · answered Feb 11 '14 at 18:15

1

Try something like this /([^R][^e][^a][^d]) (exception|error)/

answered Feb 11 '14 at 18:15

rjhdby

1,278
13
15

score 0 · Answer 4 · answered Jul 11 '13 at 18:38

0

Maybe the "beginning of line" character is what you need. I am assuming every line of the log has either "exception" or "error". So you could match for

/^(RegexpForDateTimeGoesHere)(exception|error)/i

This will match on every exception or error message which is directly following the timestamp. If there is a "Read" between the timestamp and (exception|error) it will not match.

answered Jul 11 '13 at 18:38

simonszu

356
5
14

I do not know that the exception|error will directly follow the timestamp. So this would fail if the message was "(timestamp): Oh hell everything is on fire due to an error" – David Smith Jul 11 '13 at 19:28

How do you reject a string if preceded by another string using standard POSIX regex?

4 Answers4