in reply to log file split into HoA

use strict; use warnings; use Data::Dump qw"pp"; use English; my %HoA; my @AoA; while (<DATA>) { if (my ($id,$fromto)=/: (\w+): ((?:from|to)=<.*?>),/ ){ $HoA{$id}=[$PREMATCH,$fromto,$POSTMATCH]; @AoA[$.]=[$PREMATCH,$id,$fromto,$POSTMATCH]; }else { warn "Couldn't parse <<<$_>>> at line $."; } } pp(\%HoA); pp(\@AoA); __DATA__ Dec 8 08:49:21 b.mx.sonic.net sm-mta18242: jB8GnCuK018242: from=<cj@or +eilly.com>, size=10731, class="0", nrcpts=2, msgid=<E4461FEB-1B74-461 +2-80DC-3A39B04D89B1@oreilly.com>, proto=ESMTP, daemon=MTA, relay=mwes +t.oreilly.com 209.204.146.24 Dec 8 08:49:21 b.mx.sonic.net sm-mta18528: jB8GnCuK018242: to=<mkirk@c +orp.sonic.net>,<dane@corp.sonic.net>, delay=00:00:00, xdelay=00:00:00 +, mailer=esmtp, pri=160731, relay=lds.sonic.net. 208.201.249.231, dsn +=2.0.0, stat=Sent (jB8GnLpC004736 Message accepted for delivery)

both data-lines have the same ID so maybe you don't want a HoA but a AoA

OUTPUT:

{ jB8GnCuK018242 => [ "Dec 8 08:49:21 b.mx.sonic.net sm-mta18528", "to=<mkirk\@corp.sonic.net>", "<dane\@corp.sonic.net>, delay=00:00:00, xdelay=00:00:00, mail +er=esmtp, pri=160731, relay=lds.sonic.net. 208.201.249.231, dsn=2.0.0 +, stat=Sent (jB8GnLpC004736 Message accepted for delivery) \n", ], } [ undef, [ "Dec 8 08:49:21 b.mx.sonic.net sm-mta18242", "jB8GnCuK018242", "from=<cj\@oreilly.com>", " size=10731, class=\"0\", nrcpts=2, msgid=<E4461FEB-1B74-4612-80D +C-3A39B04D89B1\@oreilly.com>, proto=ESMTP, daemon=MTA, relay=mwest.or +eilly.com 209.204.146.24\n", ], [ "Dec 8 08:49:21 b.mx.sonic.net sm-mta18528", "jB8GnCuK018242", "to=<mkirk\@corp.sonic.net>", "<dane\@corp.sonic.net>, delay=00:00:00, xdelay=00:00:00, mailer=e +smtp, pri=160731, relay=lds.sonic.net. 208.201.249.231, dsn=2.0.0, st +at=Sent (jB8GnLpC004736 Message accepted for delivery) \n", ], ]

Cheers Rolf

UPDATE: better add a chomp after the while ...

UPDATE: adding a space to the regex helps catching additional mailadresses   my ($id,$fromto)=/: (\w+): ((?:from|to)=<.*?>), /;

but be aware that you have to be sure about the format of your logs, otherwise you need a parser for mailadresses which isn't trivial