use strict;
my $str = 'Jul 5 15:25:01 10.151.18.1 Jul 5 20:25:01 srx21 RT_FLOW: RT_FLOW_SESSION_DENY: session denied 136.62.186.217/62724->96.47.223.17/445 0x0 junos-smb-session 6(0) default-drop Outside DMZ UNKNOWN UNKNOWN N/A(N/A) reth0.0 UNKNOWN policy deny
Jul 6 14:16:13 10.151.18.1 Jul 6 19:16:12 srx21 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.151.10.61/48040->10.151.150.18/8080 0x0 None 10.151.10.61/48040->10.151.150.18/8080 0x0 N/A N/A N/A N/A 6 DMZ-Trust_any DMZ Trust 1858740 N/A(N/A) reth2.10 UNKNOWN UNKNOWN UNKNOWN
Jul 6 14:16:13 10.151.18.1 Jul 6 19:16:12 srx21 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.151.150.121/34954->209.239.233.7/443 0x0 junos-https 64.17.7.244/42525->209.239.233.7/443 0x0 source rule r1 N/A N/A 6 outside-access Trust Outside 1503483 N/A(N/A) reth1.190 UNKNOWN UNKNOWN UNKNOWN
Jul 6 14:16:13 10.151.18.1 Jul 6 19:16:12 srx21 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 73.152.202.193/47878->64.17.7.246/53 0x0 junos-dns-udp 73.152.202.193/47878->10.151.10.64/53 0x0 N/A N/A static rule external-dns 17 external-dns Outside DMZ 1200031 N/A(N/A) reth0.0 UNKNOWN UNKNOWN UNKNOWN
Jul 6 17:10:13 10.151.18.1 Jul 6 22:10:12 srx21 RT_FLOW: RT_FLOW_SESSION_CREATE: session created 66.87.85.217/16879->96.47.221.72/443 0x0 junos-https 66.87.85.217/16879->10.151.10.66/443 0x0 N/A N/A destination rule websites-221 6 webtraffic-in Outside DMZ 931704 N/A(N/A) reth0.0 UNKNOWN UNKNOWN UNKNOWN
';
my $regex = qr/(?P<srx_eventType>RT_FLOW_.+):\s\w+\s\w+\s(?P<srx_sourceIP>\d+\.\d+\.\d+\.\d+)\/(?P<srx_sourcePort>\d+)->(?P<srx_destinationIP>\d+\.\d+\.\d+\.\d+)\/(?P<srx_destinationPort>\d+)\s0x0\s(?P<srx_Application>\S+)\s(?:\d\(\d\))?(?:\d+\.\d+\.\d+\.\d+\/\d+->\d+\.\d+\.\d+\.\d+\/\d+\s0x0\s)?(?:(?:N\/A\s)+)?(?:(?P<srx_natType>[a-z]+)\srule\s(?P<srx_natRule>\S+)\s)?(?:(?:N\/A\s)+)?(?:\d+)?\s(?P<srx_policyName>\S+)\s(?P<srx_zoneIn>\S+)\s(?P<srx_zoneOut>\S+)\s(?:(?:UNKNOWN UNKNOWN)|(?:\d+))\sN\/A\(N\/A\)\s(?P<srx_interfaceIn>\S+)/p;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html