Don't change your input record separator $/ = "\]";
, then you can rely on the fact that your first group is the first in the line.
Additionally, if your first group is always enclosed in ftpd[]
, then you can make your regex more restrictive just in case:
use strict;
use warnings;
while (<DATA>) {
if (/ftpd\[(.*?)\]/) {
print "$1\n";
}
}
__DATA__
Dec 1 23:59:08 ftp1 ftpd[4682]: FTP LOGIN FROM 192.168.0.1 [192.168.0.1], prd
Dec 1 23:59:10 ftp1 ftpd[4690]: FTP LOGIN FROM 192.168.0.2 [192.168.0.2], prod1
Outputs:
4682
4690