How do you reject a line if it is preceded by another line using the standard POSIX regular expression?

Question

I have a regex that finds errors in the log for me:

/(exception|error)/i 

This works, except that I do not want to be warned when the following happens, which I expect:

 DD/MM/YYYY 10:20pm: Read exception encountered 

How do I specifically reject the line "Read exception foundted"? Am I trying to use ?! operator, but failure:

 /(?!Read exception encountered)(exception|error)/i 

The above still matches the string I want to exclude.

UPDATE: After experimenting with the negative lookbehind and lookahead solutions below, I found that SiteScope only supports the basic POSIX regex functions, not advanced functions. Is it possible to use only the basic POSIX regular expression functions?

Answer 1

You want to use "Negative Lookbehind" (if supported by your regular expression engine.) Effectively you say: "I want to match X patern if this other pattern DOES NOT do it."

In your example, it looks like this:

 /(?<!read )(exception|error)/i 

more about lookaround objects here .

Answer 2

If you want to reject the entire line, if the Read exception encountered substring is in the line, then I would just use a negative forecast, which is supported by most languages.

^(?![^\r\n]*?\bRead exception encountered\b)[^\r\n]*?(exception|error)

Real-time example: http://www.rubular.com/r/CV7P9huVsI

Answer 3

Try something like this / ([^ R] [^ e] [^ a] [^ d]) (exception | error) /

Answer 4

Perhaps the “start of line” character is what you need. I assume that each line in the log has either an exception or an error. So you can match for

 /^(RegexpForDateTimeGoesHere)(exception|error)/i 

This will correspond to every exception or error message that immediately follows the timestamp. If there is a “Read” between the timestamp and (exception | error), it will not match.