# A regexp?

**URL:** <https://www.ruby-forum.com/t/a-regexp/185514>\
**Category:** Ruby\
**Created:** [March 22, 2010, 3:23am UTC](https://www.ruby-forum.com/t/a-regexp/185514 "2010-03-22T03:23:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bloodniece](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bloodniece](https://www.ruby-forum.com/u/bloodniece)\
**Post date:** [March 22, 2010, 3:23am UTC](https://www.ruby-forum.com/t/a-regexp/185514/1 "2010-03-22T03:23:50Z")

</div>

Hi All!

Thank you in advance! 🙂

I am parsing through /var/log/mail.log via regexp and I need to skip  
date lines that are NOT followed by to|from|connect. Here is my code:

mailog = “/var/log/mail.log”

```
File.open(mailog, 'r+') do |mlog|
    if mlog.flock(File::LOCK_SH) == 0
        File.foreach mailog do |line|
            ##p(line.chomp.scan(/^(.{15})\s+(\S+)\s+(\S+)\s+(.+)$/).first)
            datestr = (line.chomp.scan(/^.{15}/))
            mailmsg =

```

(line.chomp.scan(/^.?connect\sto._|to=._|host.\*$/))  
puts datestr  
puts mailmsg  
end  
else  
string = ‘LOCK\_SH was not obtained on /var/log/maillog!’  
end ### END if ###

```
    mlog.flock(File::LOCK_UN)

end ### END do mlog ###

```

The output of this code is below and I DO NOT want, can skip the output  
such as  
Mar 21 18:58:08  
Mar 21 18:58:08  
Mar 21 18:58:08

I only want ouput IF the date is followed by to=|connect\sto._|host._

to=[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), [relay=mx.dca.untd.com](http://relay=mx.dca.untd.com)[64.136.44.37]:25,  
delay=177323, delays=177322/0.02/1.8/0, dsn=4.0.0, status=deferred (host  
[mx.dca.untd.com](http://mx.dca.untd.com)[64.136.44.37] refused to talk to me: 550 Access  
denied…0b30748490a5c4c48900e4e9912059c0e18d1d24dd45d1896d5150b1f17551f975b124c9b1b12499b11974d1d44099f4d135f440c46d305d…)  
Mar 21 18:58:08  
Mar 21 18:58:08  
Mar 21 18:58:08  
to=[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), relay=none, delay=187566,  
delays=187536/0.05/30/0, dsn=4.4.1, status=deferred (connect to  
[webav.com](http://webav.com)[74.117.116.83]:25: Operation timed out)  
Mar 21 18:58:08  
to=[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), relay=none, delay=187566,  
delays=187535/0.02/30/0, dsn=4.4.1, status=deferred (connect to  
[webav.com](http://webav.com)[74.117.116.83]:25: Operation timed out)  
Mar 21 18:58:08  
Mar 21 18:58:08  
to=[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid), relay=none, delay=187576,  
delays=187546/0.02/30/0, dsn=4.4.1, status=deferred (connect to  
[mail.phoenixformations.com](http://mail.phoenixformations.com)[69.61.147.50]:25: Operation timed out)

---

<div class="post-metadata">

**Author:** ![bloodniece](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bloodniece](https://www.ruby-forum.com/u/bloodniece)\
**Post date:** [March 23, 2010, 1:09am UTC](https://www.ruby-forum.com/t/a-regexp/185514/2 "2010-03-23T01:09:58Z")

</div>

unknown wrote:

> On Sun, Mar 21, 2010 at 10:23 PM, Derek S.  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > Mar 21 18:58:08  
> > Mar 21 18:58:08  
> > Mar 21 18:58:08  
> > …  
> > I only want ouput IF the date is followed by to=|connect\sto._|host._
> 
> I stuck your regex and data in rubular,check it out:
> 
> [Rubular: ^(.{15})\s+(to|from|connect)(\S+)\s+(\S+)\s+(.+)$](http://www.rubular.com/r/zhcQ1lccgp)

I don’t see your working regexp on this page. I tested the regexp  
labeled Yours:  
^(.{15})\s+(to|from|connect)(\S+)\s+(\S+)\s+(.+)$

and it does not work!  
please advise!

---

<div class="post-metadata">

**Author:** ![bloodniece](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bloodniece](https://www.ruby-forum.com/u/bloodniece)\
**Post date:** [March 22, 2010, 4:05am UTC](https://www.ruby-forum.com/t/a-regexp/185514/3 "2010-03-22T04:05:18Z")

</div>

On Sun, Mar 21, 2010 at 10:23 PM, Derek S.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Mar 21 18:58:08  
> Mar 21 18:58:08  
> Mar 21 18:58:08  
> …  
> I only want ouput IF the date is followed by to=|connect\sto._|host._

I stuck your regex and data in rubular,check it out:

> **[Rubular](https://rubular.com/r/zhcQ1lccgp)**
>
> Ruby-based regular expression editor/tester