Your regexen look reasonable enough to me. One way to keep your code a little cleaner when you have more than a couple of captures is with the use of the /x modifier and the new-ish named captures:
#!/usr/bin/env perl use 5.014; use warnings; $_ = <DATA>; chomp; /^ (?<mon>\w+)\s(?<dd>\d\d) \s (?<time>..:..:..) # could capture hh:mm:ss separately if need be \s (?<src>\d+\.\d+\.\d+\.\d+) # keep going with your sub-expressions /x; say "time: $+{time} src: $+{src}"; __DATA__ May 20 18:57:27 1.23.25.5 %ASA-6-106100 a6 [local4.info] access-list M +yaccess-Block permitted tcp outside/10.31.0.9(3803) -> inside/10.29.1 +0.91(4127) hit-cnt 1 300-second interval [0xa178b29d, 0x0]
Edit: I note you match dotted-quad IP addresses frequently. If it helps, you can throw that pattern in a variable for re-use:
my $IP_ADDR = qr/\d+\.\d+\.\d+\.\d+/; /...(?<src>$IP_ADDR).../
In reply to Re: A better way to parse this with regexes? Pix ASA logs
by rjt
in thread A better way to parse this with regexes? Pix ASA logs
by symgryph
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |