use strict;
my $str = 't=2019-07-30T07:22:35+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=22 name="Выдача сломалась!" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:39+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=48 newState=alerting prev state=ok
t=2019-07-30T07:22:39+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/TylgxQWG4Aiq6kmlSrM4.png
t=2019-07-30T07:22:39+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/lsfc738fTMkR034AZM2j.png
t=2019-07-30T07:22:39+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook
t=2019-07-30T07:22:39+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook
t=2019-07-30T07:22:40+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=89 name=Вход.Формы.Статусы error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:40+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=89 newState=alerting prev state=ok
t=2019-07-30T07:22:40+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=88 name="Exception State alert" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:40+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/tQeLMXFNBU6y6USKOe5E.png
t=2019-07-30T07:22:40+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook
t=2019-07-30T07:22:42+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=21 name="HermesApiErrors alert" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:42+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=26 name="Генерация отчетов на Jasper alert" error="Alert execution exceeded the timeout" changing state to=keep_state
t=2019-07-30T07:22:45+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=32 name="СРВО. Фоновые задачи" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:45+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=32 newState=alerting prev state=ok
t=2019-07-30T07:22:45+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/yZzqi4QmGCvSbYraq3UC.png
t=2019-07-30T07:22:45+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook
t=2019-07-30T07:22:45+0300 lvl=info msg="Sending alert notification to" logger=alerting.notifier.email addresses="[Andrey.Kudashkin@russianpost.ru Arkhipov.Alexander@russianpost.ru szhogin@luxoft.com OPodus@luxoft.com]"
t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=135 name="pochtaid-sso alert" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=135 newState=alerting prev state=ok
t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=90 name="Профиль. Статус" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=90 newState=alerting prev state=ok
t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=136 name="Normalization alert" error="Alert execution exceeded the timeout" changing state to=alerting
t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=136 newState=alerting prev state=ok
t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/qXR85haxAmRX5g1vqrmT.png
t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/dOfYePDh7n3oreQhaRCR.png
t=2019-07-30T07:22:47+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook
t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/4eIoX3qCRuF16DoXNbRU.png
';
my $regex = qr/^t=(?<longtime>[^ ]+)\s*lvl=(?<loglevel>[^ ]+)\s*msg=(?<msg>(?:"[^"]+"|[^ ]+))\s*logger=(?<logger>[^ ]+)\s*(?:addresses=(?<email>(?:"\[[^"]+\]"|[^ ]+)))?(?:userId=(?<userID>[^ ]+))?\s*(?:orgId=(?<orgID>[^ ]+))?\s*(?:uname=(?<uname>[^ ]+|[??]*))?\s*(?:method=(?<method>[^ ]+))?\s*(?:path=(?<path>(?:"[^"]+"|[^ ]+)))?\s*(?:ruleId=(?<ruleID>[^ ]+))?\s*(?:name=(?<name>(?:"[^"]+"|[^ ]+)))?\s*(?:error=(?<error>(?:"[^"]+"|[^ ]+)))?\s*(?:changing state to=(?<ChStateTo>[^ ]+))?\s*(?:status=(?<status>[^ ]+))?\s*(?:remote_addr=(?<remote_addr>[^ ]+))?\s*(?:time_ms=(?<time_ms>[^ ]+))?\s*(?:size=(?<size>[^ ]+))?\s*(?:referer=(?<referer>(?:"[^"]+"|[^ ]+)|[??]*))?\s*(?:alertId=(?<alertID>[^ ]+))?\s*(?:newState=(?<NewState>[^ ]+))?\s*(?:prev state=(?<prevState>[^ ]+))?\s*(?:url=(?<url>[^ ]+))?$/mp;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html