Find overlapping matches with plain regular expression

Question

I'm using the following regular expression to find Start-Stop-Blocks of applications inside a server log file:

\[\d{2}\.\d{2}\.\d{2}\s\d{2}\:\d{2}\:\d{2}\:\d{1,3}\sMET\].+The Application\s([a-zA-Z0-9]*)\sis starting\.[\s\S]*\[\d{2}\.\d{2}\.\d{2}\s\d{2}\:\d{2}\:\d{2}\:\d{1,3}\sMET\].+The Application started:\s\1

The server log format looks something like this:

[10.12.19 15:29:10:408 MET] 0000006a ApplicationMg A  WSVR0200I: The Application query is starting.
[10.12.19 15:29:11:102 MET] 0000006a CompositionUn A  WSVR0191I: Composition unit AB started
[10.12.19 15:29:11:222 MET] 0000006a CompositionUn A  WSVR0191I: Composition unit CD started
[10.12.19 15:29:11:412 MET] 0000006a ApplicationMg A  WSVR0200I: The Application tracer is starting.
[10.12.19 15:29:12:108 MET] 0000006a CompositionUn A  WSVR0191I: Composition unit DE started.
[10.12.19 15:29:12:541 MET] 0000006a ApplicationMg A  WSVR0200I: The Application started: query
[10.12.19 15:29:13:417 MET] 0000006a ApplicationMg A  WSVR0200I: The Application started: tracer

[10.12.19 15:30:12:145 MET] 0000006a ApplicationMg A  WSVR0200I: The Application test is starting.
[10.12.19 15:30:13:408 MET] 0000006a CompositionUn A  WSVR0191I: Composition unit XY started.
[10.12.19 15:30:14:678 MET] 0000006a ApplicationMg A  WSVR0200I: The Application started: test

There are three apps in this server log: query, tracer and test. The expression will result in two matches: The Start-Stop-logs for query (line 1-6) and test (line 9-11). But it doesn't match the nested tracer-app-logs (line 4-7).

Is it possible to catch nested / overlapping matches with regex?

regex101.com

What flavour of regex? Show the desired output for your example input. How big are your server log files? — jhnc, Dec 12 '19 at 15:05
Perhaps you are looking for [this](https://stackoverflow.com/q/11898998/823738) ? — Zaffy, Dec 12 '19 at 15:55

score 0 · Accepted Answer · answered Dec 15 '19 at 13:49

Thanks to @jhnc, I was able to find the solution with the use of a positive lookahead:

(?=(\[\d{2}\.\d{2}\.\d{2}\s\d{2}\:\d{2}\:\d{2}\:\d{1,3}\sMET\].+The Application\s([a-zA-Z0-9]*)\sis starting\.[\s\S]*\[\d{2}\.\d{2}\.\d{2}\s\d{2}\:\d{2}\:\d{2}\:\d{1,3}\sMET\].+The Application started:\s\2))

See also the following regex example: https://regex101.com/r/XuFLPm/4

Find overlapping matches with plain regular expression

1 Answers1