Both your approaches need both the start point and the end point actually appear in the data. Is this the case? If not, you have to do a bit more work: compare the times in the log with start/end points.
Update: The approach #2 seems weird. The regular expression suggests you should have read all the lines into one string.