Regex: select the XML messages and time stamp from the log

Question

I am going to streaming the logs in to nxlog, i need to push xml messages in to nexlog server, To select the XML message:

(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3})(.*)(my sentence 1....|my sentence 2 : [\S+\s+]*>\n)(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3})

But I am not able to select all XML messages from logs

https://regex101.com/r/iA8qE5/5

Answer 1

In your regex you have to close the alternation using ) after:

(Message Picked from the queue....|Response Message :

Using a + inside the character class would have a different meaning and would match a plus sign literally. The plus is greedy so you have to make it non greedy using a question mark to let [\S\s]+ not match all lines.

Update [\S+\s+]*>\n)

to

)([\S\s]+?>)\n

Your match is in the 4th capturing group.

(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3})(.*)(Message Picked from the queue....|Response Message : )([\S\s]+?>)\n(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3})

Regex demo

Not that if you don't need all the capturing groups, you can also omit them and take only the first capturing group (Demo)

Answer 2

it capture date from starting line, message and xml. it using gms flag, Demo

^([\d-\.\s\:]+)\s.*?-\s([\w\s:\.]+)(<\w+.*?)\n\d{4}

date and xml only

^([\d-\.\s\:]+)\s.*?(<\w+.*?)\n\d{4}