comment on

What is that syntax? See perlfaq6#How can I hope to use regular expressions without creating illegible and unmaintainable code?

write something like this (incomplete examples)
for perl 5 and up
my $re_asalog = qr{ ^ (.{15}) # $1 timestamp \s (\S+) # $2 firewall \s (\S+) # $3 part firewall access-list \s+ (\S+) # $4 source acl \s+ (\S+) # $5 action ... }xm;
[download]
for perl-5.10 and up
my $re_asalog = qr{ ^ # start of line (?<time> .{15} ) \s \s (?<firewall> \S+ ) \s (?<part_firewall> \S+ ) \s access-list \s (?<source_acl> \S+ ) \s (?<action> \S+ ) \s (?<protocol> \S+ ) \s (?<source_interface> \S+ ) \s (?<source_ip> \S+ ) \s (?<source_port> \S+ ) # ... $ # end of line }mx;
[download]

running example using named capture buffers instead of numbered ones , See perlvar#% , perlre#(?<NAME>pattern) , and #(DEFINE)

#!/usr/bin/perl --
use Data::Dump ;
use 5.010;
use re 'debug';
$_=1234;
m{
  (?<P>(?&V))  # match <V> and save to $+{P} 
  (?<Q> .)     # match <Q> and save to $+{Q}

# this can be saved in $v_definition = qr//
  (?(DEFINE)
    (?<V> ...) # <V> aka (?&V) is three chars
  )
}xm;
dd\%+
__END__
Compiling REx "%n  (?<P>(?&V))  # match <V> and save to $+{P} %n  (?<Q
+> .) "...
synthetic stclass "ANYOF{i}[\x00-\x09\x0b-\xff][{non-utf8-latin1-all}{
+unicode_all}]".
Final program:
   1: OPEN1 'P' (3)
   3:   GOSUB3[+14] (6)
   6: CLOSE1 'P' (8)
   8: OPEN2 'Q' (10)
  10:   REG_ANY (11)
  11: CLOSE2 'Q' (13)
  13: DEFINEP (15)
  15: IFTHEN (27)
  17:   OPEN3 'V' (19)
  19:     REG_ANY (20)
  20:     REG_ANY (21)
  21:     REG_ANY (22)
  22:   CLOSE3 'V' (27)
  24:   LONGJMP (26)
  26:   TAIL (27)
  27: END (0)
stclass ANYOF{i}[\x00-\x09\x0b-\xff][{non-utf8-latin1-all}{unicode_all
+}] minlen 4 
Matching REx "%n  (?<P>(?&V))  # match <V> and save to $+{P} %n  (?<Q>
+ .) "... against "1234"
Matching stclass ANYOF{i}[\x00-\x09\x0b-\xff][{non-utf8-latin1-all}{un
+icode_all}] against "1" (1 bytes)
   0 <> <1234>               |  1:OPEN1 'P'(3)
   0 <> <1234>               |  3:GOSUB3[+14](6)
   0 <> <1234>               | 17:  OPEN3 'V'(19)
   0 <> <1234>               | 19:  REG_ANY(20)
   1 <1> <234>               | 20:  REG_ANY(21)
   2 <12> <34>               | 21:  REG_ANY(22)
   3 <123> <4>               | 22:  CLOSE3 'V'(27)
                                    EVAL trying tail ... 0
   3 <123> <4>               |  6:    CLOSE1 'P'(8)
   3 <123> <4>               |  8:    OPEN2 'Q'(10)
   3 <123> <4>               | 10:    REG_ANY(11)
   4 <1234> <>               | 11:    CLOSE2 'Q'(13)
   4 <1234> <>               | 13:    DEFINEP(15)
   4 <1234> <>               | 15:    IFTHEN(27)
   4 <1234> <>               | 27:    END(0)
Match successful!
{
  # tied Tie::Hash::NamedCapture
  P => 123,
  Q => 4,
}
Freeing REx: "%n  (?<P>(?&V))  # match <V> and save to $+{P} %n  (?<Q>
+ .) "...
[download]

In reply to Re: A better way to parse this with regexes? Pix ASA logs by Anonymous Monk
in thread A better way to parse this with regexes? Pix ASA logs by symgryph

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.