The regular expression "NOT" in the group

Question

I have this regex:

<(\d+)>(\w+\s\d+\s\d+(?::\d+){2})\s([\w\/\.\-]*)(.*) 

What I want to do is return FALSE (does not match) if the third group is "MSWinEventLog" and returns a "match" for the rest.

 <166>Apr 28 10:46:34 AMC the remaining phrase <11>Apr 28 10:46:34 MSWinEventLog the remaining phrase <170>Apr 28 10:46:34 Avantail the remaining phrase <171>Apr 28 10:46:34 Avantail the remaining phrase <172>Apr 28 10:46:34 AMC the remaining phrase <173>Apr 28 10:46:34 AMC the remaining phrase <174>Apr 28 10:46:34 Avantail the remaining phrase <175>Apr 28 10:46:34 AMC the remaining phrase <176>Apr 28 10:46:34 AMC the remaining phrase <177>Apr 28 10:46:34 Avantail the remaining phrase <178>Apr 28 10:46:34 AMC the remaining phrase <179>Apr 28 10:46:34 Avantail the remaining phrase <180>Apr 28 10:46:34 Avantail the remaining phrase 

How to put " NOT ' MSWinEventLog '" in the regex group ([\w\/\.\-]*) ?

Note:
The second phrase above should return "inconsistency"

Answer 1

 <(\d+)>(\w+\s\d+\s\d+(?::\d+){2})\s(?!MSWinEventLog)([\w\/\.\-]*)(.*) 

A negative scan (here: ' (?!MSWinEventLog) ') should be sufficient:

A negative lookup is necessary if you want to match something that is not followed by something else .
In explaining character classes, I already explained why you cannot use a negative character class to match "q" and not "u". A negative look provides a solution: q(?!u) .

Answer 2

You can do it with a negative look:

 <(\d+)>(\w+\s\d+\s\d+(?::\d+){2})\s(?!MSWinEventLog)([\w\/.-])(.) ----------------- 

(?!MSWinEventLog) will match only if the expression matching "MSWinEventLog" does not immediately follow.