0

the code below works fine if the username is existed but what if there is "-" instead (no username)

(?P<host>\d{3}.\d{3}.\d{3}.\d{3}) - (?P<user_name>\w*) \[(?P<time>.*?)\] \"(?P<request>.*?)\"

username exists:

146.204.224.152 - feest6811 [21/Jun/2019:15:45:24 -0700] "POST /incentivize HTTP/1.1" 302 4622

no username:

159.253.153.40 - - [21/Jun/2019:15:46:10 -0700] "POST /e-business HTTP/1.0" 504 19845
Barmar
  • 741,623
  • 53
  • 500
  • 612
Hossam Fid
  • 15
  • 4

2 Answers2

0

The field isn't optional, it's always there. But sometimes it contains a username, other times it contains -. So just use alternatives with | in the regexp to match either of them.

Also, \w* will allow a completely empty username, which is probably not allowed. Use \w+ to match a non-empty field.

(?P<host>\d{3}.\d{3}.\d{3}.\d{3}) - (?P<user_name>\w+|-) \[(?P<time>.*?)\] \"(?P<request>.*?)\"
Barmar
  • 741,623
  • 53
  • 500
  • 612
0

You could try editing your RegEx to match the - case as well, like this:

(?P<host>\d{3}.\d{3}.\d{3}.\d{3}) - (?P<user_name>\w*|-) \[(?P<time>.*?)\] \"(?P<request>.*?)\"

I used Debuggex to try your RegEx out.

Rafael de Bem
  • 641
  • 7
  • 15