I have the following string produced by a server log file. I am using Simple Event Correlator (which uses perl regex) to manipulate lines:

18:37:31 643.65.123.123 []sent /home/mydomain/public_html/court-954fdw/Chairman-confidential-video.mpeg 226 court-954fdw@mydomain.com 256

and I have been successful in using perl regex to successfully extract the user who logs in with the following pattern.

NOTE: the values that SEC uses are extracted from the data contained in the parenthesis:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(.*)

However, I have been unsuccessful in parsing out just the file name which in this case would be: Chairman-confidential-video.mpeg.

Currently the existing pattern I use pulls out the entire string:

Chairman-confidential-video.mpeg 226 court-954fdw@mydomain.com 256

which I don't want. Any help much appreciated.


I would probably use:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(\S+).*

This should extract out all but whitespace characters for the last capturing match, and leave the rest for the non-capturing match.


I'd use the following:

pattern=sent \/home\/mydomain\/public_html\/(.*?)\/\(.* ?)\S*.*$

For more explicit non-greedy matching. Your result will now be in $2. This assumes that you can't hard-code anything below public_html. This does leave a trailing space.

  • Regex is invalid due to erroneous escaping of 3rd parenthesis. Not able to edit it. – matthiash Jul 6 '16 at 19:23

Other answers assumes no whitespace in filename, a rather risky assumption. A safer bet is to assume no slashes in filename, as that is illegal in linux:

pattern=sent \/home\/mydomain\/public_html\/([^\/]+)\/([^\/]+) [0-9]+ \S+@\S+ [0-9]+$

Tested at https://regex101.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.