Regular expression to find a pattern and the first occurrence of another text pattern before it

Question

I am trying to write a regex to extract an event from a log file plus the time it happened. Unfortunately the log file is not very structured, as the 3rd party logger inserts time stamps asynchronously to my logged text. I can identify the event by ID:00000015fd6c

An example is :

[2017/4/16 2:28:29AM]  (I) Radio mode changed to 
SYSAXRADIO_E_STATE_PAGER_RX_SYNC on 170.9 MHz

[2017/4/16 2:28:37AM]  Tock = 1718 
(I) IDTAG TAG : -90dBm : ID:00000015fd6c
(I) ***************
(I) ID TAG DETECTED 00000015FD6C
(I) ***************

Currently the regex I have is: (?<=2017)[\s\S]*?ID:00000015fd6c

I want:

[2017/4/16 2:28:37AM]  Tock = 1718 
(I) IDTAG TAG : -90dBm : ID:00000015fd6c

but I get:

[2017/4/16 2:28:29AM]  (I) Radio mode changed to 
SYSAXRADIO_E_STATE_PAGER_RX_SYNC on 170.9 MHz

[2017/4/16 2:28:37AM]  Tock = 1718 
(I) IDTAG TAG : -90dBm : ID:00000015fd6c

The text I want is the all including "ID:00000015fd6c" backwards up to the first time stamp before the matching text.

Help please?

Answer 1

You can use a tempered greedy token like this:

\[2017\/(?:(?!\[\d{4}\/\d{1,2}\/\d)[\s\S])*?ID:00000015fd6c
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

See the regex demo

Details

• \[2017\/ - a [2017/ string
• (?:(?!\[\d{4}/\d{1,2}/\d)[\s\S])*? - any symbol, 0+ occurrences, as few as possible, that does not start a sequence:
  • \[ - a literal [
  • \d{4}\/\d{1,2}\/\d - 4 digits, /, 1 or 2 digits, /, a digit
• ID:00000015fd6c - a ID:00000015fd6c string