RegEx “replace all but” for Notepad++ v6.3

Question

First timer and relatively inexperienced with RegEx and Notepad++. What I am trying to do is replace everything but the policy numbers in these two firewall session. Mind you, I have a list multiple lists 700+ lines long so I want to replace everything in one pass, leaving just the policy number for each line.

id 1978781/s23,vsys 0,flag 00200440/4000/0003,policy 4332,time 5972, dip 0 module 0
id 1997645/s23,vsys 0,flag 00200440/4000/0003,policy 30562,time 6283, dip 0 module 0

There are thousands of different policy numbers, so a simple search wont do.

I would like my lines to look like this after a replace.

4332
30562

After two hours of trying to learn RegEx for this one problem, I realized this its more involved than I expected, and I need to spend time learning this since its a very powerful tool. This could really save a lot of time, which unfortunately I don't have at the moment. I'm looking forward to learning more about RegEx and appreciate any help or direction you could give me.

Answer 1

Given the fact the lines always look the same you can use the following

^.+policy (\d+).+$

Replace by : $1

The dot is a wild card so , .+ means find everything before the word "policy ". Then find a group of digits (\d+ is for finding digits) and save them (thats what the parenthesis are for in many regex engines). Then find all the characters till the end of the line.

The ^ character means start of line. The $ means end of line.

Answer 2

You can try the following:

Find:

^.*policy ([0-9]+).*$

Replace with:

\1

Why does this work?

The dot matches any character, and the star means "zero or more of" the character preceding it. This means that .* matches everything.

What you want is to match everything before and after the policy and erase it, and keep just the policy number, so between your everything matchers you look for the string "policy xxxxx" where the xxxxx are numbers.

Each term surrounded by parenthesis in your regex is saved to be used in the replacement. I put parenthesis around the number matcher, [0-9]+ and then use what was matched in the repace part with \1. If your regex contains several parenthesized parts, you can get them with \1, \2, \3...

Regexes are really powerful, you should read a tutorial about them to learn what they can offer.