Regex Skip Similar Results

Question

I am trying to find a way to solve the situation when I look at PCAP files. I am looking for the header "Content-Type :. *" After an HTTP OK response. However, in the following example:

HTTP/1.1 200 OK
date:
asdf
X-Content-Type: aadsf
Content-Type: application/json
more: stuff

HTTP/1.1 200 OK
date:
asdf
X-Content-Type: aadsf
Content-Type: application/json
more: stuff

The current current regular expression "HTTP\/1.1 200 OK[\s\S]*?Content-Type:.*"stops the capture group at X-Content-Type: aadsf. My goal is a regex capture group to go to Content-Type: application/json.

Any regex masters that can give me some pointers?

Answer 1

PCRE regular expression without search that you can use,

(?m)^HTTP.*(?:\R.+)*?\RContent-Type:\s*\K.+

regex. , .+ .++. (CR)? LF:

^HTTP.*(?:\r?\n.+)*?\r?\nContent-Type:\s*(.+)

, m , ^ , , - .

• ^ -
• HTTP -
• .* -
• (?:\R.+)*? - 0+, , (\R \r?\n), 1 ,
• \R -
• Content-Type: -
• \s* - 0+
• \K - reset, ,
• .+ - 1 , .

Answer 2

^HTTP             # match HTTP at the start of the line
(?s:(?!^$).)+?    # anything lazily, do not overrun an empty newline
^Content-Type:\s* # Content-Type: at the start of a line
(?P<type>.+)      # capture the type

regex101.com.

Answer 3

Here is a regular expression ^((?:X-)?Content-Type):(.*)$that captures both types of content. Or just add \n(newline) before Content-Typeif you want it to stop after one additional content type.