Drill 07: Lookahead

# Match MACs followed by "Passed" (successful auth)
grep -oP '[0-9A-F:]{17}(?=.*Passed)' /var/log/ise-psc.log

# Match usernames NOT followed by "Failed"
grep -oP 'User-Name=\K\w+(?!.*Failed)' /var/log/ise-psc.log

# Match IPs followed by specific policy
grep -oP '[\d.]+(?=.*Wired_802\.1X)' /var/log/ise-psc.log

# Error messages followed by stack traces
grep -P 'ERROR(?=.*at .+\.java:\d+)' app.log

# Match timestamps followed by ERROR/FATAL
grep -oP '\d{4}-\d{2}-\d{2}T[\d:]+(?=.*(ERROR|FATAL))' app.log

# API calls NOT followed by 200
grep -P 'GET /api/\w+(?!.*200)' access.log

# Interfaces with IP but NOT shutdown
grep -P 'interface \w+(?=.*ip address)(?!.*shutdown)' config.txt

# VLANs followed by specific name patterns
grep -oP 'vlan \d+(?= name (DATA|VOICE|MGMT))' config.txt

# ACLs NOT followed by "permit any any" (potential security)
grep -P 'ip access-list \w+(?!.*permit any any)' config.txt

# Subjects containing "urgent" followed by action words
grep -Pi 'subject:.*urgent(?=.*(action|required|asap))' ~/mail/

# From addresses NOT followed by @spam domains
grep -Pi 'from:.*@\w+(?!\.(spam|junk|promo)\.)' ~/mail/

# Files with dates followed by specific types
ls | grep -P '\d{4}-\d{2}-\d{2}(?=.*(report|summary|review))'

# Notes containing TODO followed by priority
grep -Pi 'TODO(?=.*(high|urgent|p1))' ~/notes/*.md

# Entries with amounts followed by category
grep -oP '\$[\d.]+(?=.*(groceries|utilities|rent))' ~/budget.txt

# Workout entries followed by duration
grep -oP '\w+day(?=.*\d+ min)' ~/fitness.log

# Meals NOT followed by "healthy" tag
grep -P 'meal:.*(?!.*#healthy)' ~/diet.log

# Weight entries followed by trend indicator
grep -oP '[\d.]+(?= (kg|lbs).*↓)' ~/weight.log

# Basic positive lookahead
grep -oP 'foo(?=bar)' file.txt

# Basic negative lookahead
grep -oP 'foo(?!bar)' file.txt

# Multiple conditions
grep -oP '(?=.*pattern1)(?=.*pattern2).*' file.txt

# Combined with other features
grep -oP '(?=.*\d)[A-Za-z]+' file.txt

import re

text = "foobar foobaz fooqux"

# Positive lookahead
pattern = re.compile(r'foo(?=bar)')
matches = pattern.findall(text)
print(matches)  # ['foo'] - only before 'bar'

# Negative lookahead
pattern = re.compile(r'foo(?!bar)')
matches = pattern.findall(text)
print(matches)  # ['foo', 'foo'] - before 'baz' and 'qux'

# Password validation
def validate_password(pwd):
    pattern = re.compile(
        r'^(?=.*\d)'       # Must have digit
        r'(?=.*[a-z])'     # Must have lowercase
        r'(?=.*[A-Z])'     # Must have uppercase
        r'(?=.*[!@#$%])'   # Must have special
        r'.{8,}$'          # 8+ characters
    )
    return bool(pattern.match(pwd))

# Conditional extraction
text = "price: $99.99 USD, price: 50 EUR"
pattern = re.compile(r'\$[\d.]+(?= USD)')
usd_prices = pattern.findall(text)  # ['$99.99']

const text = "foobar foobaz fooqux";

// Positive lookahead
const positive = text.match(/foo(?=bar)/g);
console.log(positive);  // ['foo']

// Negative lookahead
const negative = text.match(/foo(?!bar)/g);
console.log(negative);  // ['foo', 'foo']

// Password validation
const passwordRegex = /^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[!@#$%]).{8,}$/;
console.log(passwordRegex.test("Password1!")); // true

# sed doesn't support lookahead natively
# Workaround: Use grep -P for filtering, then sed

# Extract then transform
grep -oP 'foo(?=bar)' file.txt | sed 's/foo/FOO/'

# Or use perl for one-liner
perl -pe 's/foo(?=bar)/FOO/g' file.txt

# awk doesn't support lookahead
# Workaround: Two-step matching

# Check if pattern exists, then extract
awk '/foobar/ {gsub(/bar/, ""); print}' file.txt

# Or use PCRE with gawk (if available)
gawk 'match($0, /foo(?=bar)/, a) {print a[0]}' file.txt

# WRONG: Lookahead at wrong position
echo "foobar" | grep -oP '(?=bar)foo'
# No match - looking for "bar" at position 0, then "foo"

# CORRECT: Lookahead after the match point
echo "foobar" | grep -oP 'foo(?=bar)'
# Match: "foo"

# Lookahead doesn't consume - pattern continues from same position
echo "foobar" | grep -oP 'foo(?=bar)bar'
# Match: "foobar" - after lookahead, "bar" still needs to be matched

# vs capturing group which DOES consume
echo "foobar" | grep -oP 'foo(bar)'
# Match: "foobar" - "bar" was consumed by the group

# FAILS: No lookahead in basic grep
grep 'foo(?=bar)' file.txt  # Literal match!

# CORRECT: Use PCRE
grep -P 'foo(?=bar)' file.txt

# Or use awk/sed workarounds for BRE/ERE

# Complex nested lookaheads can be confusing
# (?=(?=.*a)(?=.*b))  # Redundant nesting

# Simpler: Multiple lookaheads at same level
(?=.*a)(?=.*b)  # Check for 'a' AND 'b' anywhere

# Lookahead: Stop AT the pattern (don't include it)
echo "foo:bar:baz" | grep -oP '.+(?=:baz)'
# Output: foo:bar

# Lazy: Match minimum up to pattern
echo "foo:bar:baz" | grep -oP '.+?:'
# Output: foo:

# Different purposes - understand which you need