Need REGEX Expert

[gacoon]

Sorry to say I've tried for a couple of mornings to write a Regex expression to do the following:

line contains the following three items, they would be an AND condition:
1) word: "Unsubscribe"
2) character string: "http:"
3) character string: "johndoe"

Thanks for any help,
Gerry

 

[mkosmo]

Will they be in any particular order?

 

[asicer]

Shell? grep Unsubscribe | grep http: | grep johndoe

Perl?

($_ =~ m/Unsubscribe/) && ($_ =~ m/http:/) && ($_ =~ m/johndoe/)

 

[gacoon]

>Will they be in any particular order?

Yes ordered as first post:

1) word: "Unsubscribe"
2) character string: "http:"
3) character string: "johndoe"

 

[gacoon]

Shell? grep Unsubscribe | grep http: | grep johndoe

Perl?

($_ =~ m/Unsubscribe/) && ($_ =~ m/http:/) && ($_ =~ m/johndoe/)

Those wont work for me. Needs to use the basic REGEX syntax, expression must pass a testor such as this one:

https://regex101.com/

this will be used in Comcasts user developed SPAM filter area - they have an option that allows REGEX formulas to scan parts of incoming email. Of course they have no documentation on how to use it.

thanks, gerry

 

[dmspilot]

Unsubscribe.*http:.*johndoe

 

[asicer]

Unsubscribe.*http:.*johndoe

Will fail on " Unsubscribe johndoe@fakemail.org http://foo.com"

Those wont work for me. Needs to use the basic REGEX syntax, expression must pass a testor such as this one:

https://regex101.com/

this will be used in Comcasts user developed SPAM filter area - they have an option that allows REGEX formulas to scan parts of incoming email. Of course they have no documentation on how to use it.

thanks, gerry

Will it take nested groups? ((Unsubscribe.*johndoe.*http: )|(johndoe.*Unsubscribe.*http: )|etc|etc|etc)

 

[dmspilot]

Will fail on " Unsubscribe johndoe@fakemail.org http://foo.com"

He said they would be in order.

 

[DaleB]

[Uu]nsubscribe.+http:.+johndoe

Is there something more complicated I'm not seeing here?

 

[gacoon]

I could not get either of the these two to pass the testor at: https://regex101.com/
using the following test string:

USA Unsubscribe \\http:/xfinity.amazon.johndoe@comcast.net

Unsubscribe.*http:.*johndoe
[Uu]nsubscribe.+http:.+johndoe

Both fail with no matches, the order would be nice but even it identified lines containing those values would do it.

The psuedo code for this is:

If line contains Word <XYZ> and character string <abc> and character string <xyz>

 

[gacoon]

I tried a different REGEX tester ( https://regexr.com/ ) and:

[Uu]nsubscribe.+http:.+johndoe works - thank you DaleB
Unsubscribe.*http:.*johndoe works also thank you dsmpilot

Now I'll try it in my comcast profile, that will be interesting.

Thank you both!

 

[dmspilot]

I could not get either of the these two to pass the testor at: https://regex101.com/
using the following test string:

USA Unsubscribe \\http:/xfinity.amazon.johndoe@comcast.net

Unsubscribe.*http:.*johndoe
[Uu]nsubscribe.+http:.+johndoe

Both fail with no matches, the order would be nice but even it identified lines containing those values would do it.

The psuedo code for this is:

If line contains Word <XYZ> and character string <abc> and character string <xyz>

Looks like a pass to me.

 

[gacoon]

Update both these scripts work fine in the Comcast REGEX filter capability - I am now able to weed out a really knarly piece of SPAM that was coming several times a day. I had been studying its format and could see one way to id it.
So thanks to you guys I got it and learned some stuff, thanks,
Gerry

 

[gacoon]

Looks like a pass to me.

View attachment 64479

maybe I was using that one incorrectly?? It does work though, I just finished testing it real world with comcast filtering and it works great, thanks

 

[asicer]

He said they would be in order.

Ah, must have missed that post

 

[DaleB]

I wasn't much good with regex until I started needing to use Splunk's rex command. I'm picking up speed quickly.