This uses a hash a bit like jethro's solution but it is populated by split'ing the tags part of the line after the timestamp and tags string have been captured. I use the hex representation of [ and ] in the regular expression to avoid confusing escaping. I've added another line to the log with the '48=' tag missing to show the change in output.

use strict; use warnings; my @wanted = qw{ 55 48 22 }; while ( <DATA> ) { my( $head, $tagStr ) = m{ (.*) \s+\x5b ([^\x5d]+) }x; print qq{Line : $head\n}; my %tags = map { split m{=} } split m{\x01}, $tagStr; print qq{Tags found:\n}, map { sprintf qq{ %-3s => %s\n}, $_, $tags{ $_ } } sort { $a <=> $b } keys %tags; print qq{Wanted : }, join q{|}, map { exists $tags{ $_ } ? $tags{ $_ } : q{} } @wanted; print qq{\n===========\n}; } __END__ 2009/01/15 01:23:45:678: ASDF: [8=FIX.4.49=22835=D49=ZYXW56=MYCO3 +4=652=20090115-01:23:45116=BLAH129=HALB50=MEH1=HEM11=abcefg1234 +5615=ZZZ21=122=538=10040=244=4.8000000048=ZVZZT.N54=255=ZVZZ +T59=060=20090115-01:23:45100=MEH10=111] 2009/01/15 01:27:09:154: QWER: [8=FIX.4.49=22835=D49=ZYXW56=MYCO3 +4=652=20090115-01:23:45116=BLAH129=HALB50=MEH1=HEM11=abcefg1234 +5615=ZZZ21=122=538=10040=244=4.8000000054=255=ZVZZT59=060=2 +0090115-01:23:45100=MEH10=111]

The output.

Line : 2009/01/15 01:23:45:678: ASDF: Tags found: 1 => HEM 8 => FIX.4.4 9 => 228 10 => 111 11 => abcefg123456 15 => ZZZ 21 => 1 22 => 5 34 => 6 35 => D 38 => 100 40 => 2 44 => 4.80000000 48 => ZVZZT.N 49 => ZYXW 50 => MEH 52 => 20090115-01:23:45 54 => 2 55 => ZVZZT 56 => MYCO 59 => 0 60 => 20090115-01:23:45 100 => MEH 116 => BLAH 129 => HALB Wanted : ZVZZT|ZVZZT.N|5 =========== Line : 2009/01/15 01:27:09:154: QWER: Tags found: 1 => HEM 8 => FIX.4.4 9 => 228 10 => 111 11 => abcefg123456 15 => ZZZ 21 => 1 22 => 5 34 => 6 35 => D 38 => 100 40 => 2 44 => 4.80000000 49 => ZYXW 50 => MEH 52 => 20090115-01:23:45 54 => 2 55 => ZVZZT 56 => MYCO 59 => 0 60 => 20090115-01:23:45 100 => MEH 116 => BLAH 129 => HALB Wanted : ZVZZT||5 ===========

I hope this is of interest.

Cheers,

JohnGG


In reply to Re: Log Parsing using Regex by johngg
in thread Log Parsing using Regex by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.