#!/usr/bin/env perl use 5.010; use strict; use warnings; my @test_subjects = ( '--[RV: vRealize Operations Manager] new alert Type:Virtualization/Hypervisor, Sub-Type:Availability, State:critical, Object Type:VMwareAdapter Instance, Name:HOSTVCENTER01 from 192.168.1.121---', '--[RV: vRealize Operations Manager] new State:critical, Object Type:VMwareAdapter Instance, alert Type:Virtualization/Hypervisor, Sub-Type:Availability, Name:HOSTVCENTER01 from 192.168.1.121---', '--[RV: vRealize Operations Manager] new alert Type:Virtualization/Hypervisor, State:critical, Name:HOSTVCENTER01 from 192.168.1.121---', ); my $subject_re = qr{(?x: (?> Manager ] \s+ (? \S+ ) | alert \s Type: (? [^,]+ ) | Sub-Type: (? [^,]+ ) | State: (? [^,]+ ) | Object \s Type: (? [^,]+ ) | Name: (? \S+ ) | from \s+ (? [0-9.]+ ) ) )}; my @fields = qw{event type subtype state object host from}; my $format = '%-' . (length((sort { length $b <=> length $a } @fields)[0]) + 1) . "s %s\n"; my $pre_subject = '=== Subject ' . '=' x 30; my $post_subject = '=' x 42; my %empty; @empty{@fields} = ('Not supplied!') x @fields; for my $subject (@test_subjects) { my %captured; while ($subject =~ /$subject_re/g) { $captured{$_} = $+{$_} for keys %+; } my %found = (%empty, %captured); say for $pre_subject, $subject, $post_subject; printf $format, "$_:", $found{$_} for @fields; } #### === Subject ============================== --[RV: vRealize Operations Manager] new alert Type:Virtualization/Hypervisor, Sub-Type:Availability, State:critical, Object Type:VMwareAdapter Instance, Name:HOSTVCENTER01 from 192.168.1.121--- ========================================== event: new type: Virtualization/Hypervisor subtype: Availability state: critical object: VMwareAdapter Instance host: HOSTVCENTER01 from: 192.168.1.121 === Subject ============================== --[RV: vRealize Operations Manager] new State:critical, Object Type:VMwareAdapter Instance, alert Type:Virtualization/Hypervisor, Sub-Type:Availability, Name:HOSTVCENTER01 from 192.168.1.121--- ========================================== event: new type: Virtualization/Hypervisor subtype: Availability state: critical object: VMwareAdapter Instance host: HOSTVCENTER01 from: 192.168.1.121 === Subject ============================== --[RV: vRealize Operations Manager] new alert Type:Virtualization/Hypervisor, State:critical, Name:HOSTVCENTER01 from 192.168.1.121--- ========================================== event: new type: Virtualization/Hypervisor subtype: Not supplied! state: critical object: Not supplied! host: HOSTVCENTER01 from: 192.168.1.121