How do you reject a string if preceded by another string using standard POSIX regex?

Question

I have a regex which finds errors in a log for me:

/(exception|error)/i

This works, except that I do not want to be alerted when the following occurs, which I expect to happen:

DD/MM/YYYY 10:20pm: Read exception encountered

How do I specifically reject the 'Read exception encountered' string? I'm trying to use the ?! operator, but failing:

/(?!Read exception encountered)(exception|error)/i

The above still matches the string I want to exclude.

UPDATE: After experimenting with the negative lookbehind and lookahead solutions below, I have discovered that SiteScope supports only basic POSIX regex features, not extended features. Is a solution possible using only basic POSIX regex features?

Answer 1

You want to use "Negative Lookbehind" (if it's supported by your regex engine.) effectively you say "I want to match X patern, as long as this other pattern does NOT preceed it."

In your example, it looks like this:

/(?<!read )(exception|error)/i

see more about "lookaround" features here.

Answer 2

Try something like this /([^R][^e][^a][^d]) (exception|error)/

Answer 3

Maybe the "beginning of line" character is what you need. I am assuming every line of the log has either "exception" or "error". So you could match for

/^(RegexpForDateTimeGoesHere)(exception|error)/i

This will match on every exception or error message which is directly following the timestamp. If there is a "Read" between the timestamp and (exception|error) it will not match.

Answer 4

If you're looking to reject the entire string if the sub-string Read exception encountered is in the string, then I would simply use a negative look ahead which is supported by most languages.

^(?![^\r\n]*?\bRead exception encountered\b)[^\r\n]*?(exception|error)

Live example: http://www.rubular.com/r/CV7P9huVsI