error'ed log lines

evm.log

[----] E, [2017-08-09T08:44:32.927049 #3104:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5246422], timed out after 600.004238745 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T08:44:40.332310 #3104:12a113c] ERROR -- : MIQ(MiqGenericWorker::Runner) ID [1841] PID [3104] GUID [a6166ca2-7cf1-11e7-893a-001a4a223911] Exiting worker due to timeout error Worker exiting.
[----] E, [2017-08-09T09:05:27.346387 #15892:5d6ace0] ERROR -- : <VIM> ******* Errno::ECONNREFUSED
[----] E, [2017-08-09T09:05:27.346600 #15892:5d6ace0] ERROR -- : <VIM> Connection refused - connect(2) for "dhcp-8-99-172.com" port 443 (dhcp-8-99-172.com:443)
[----] E, [2017-08-09T09:05:27.346743 #15892:5d6ace0] ERROR -- : <VIM> /opt/rh/cfme-gemset/gems/httpclient-2.7.2/lib/httpclient/session.rb:597:in `initialize'
[----] E, [2017-08-09T09:05:27.352894 #15892:12a113c] ERROR -- : <VIM> MiqVimBroker.getMiqVim: failed to create new connection for dhcp-8-99-172.com_root
[----] E, [2017-08-09T09:05:27.353056 #15892:12a113c] ERROR -- : <VIM> Errno::ECONNREFUSED: Connection refused - connect(2) for "dhcp-8-99-172.com" port 443 (dhcp-8-99-172.com:443)
[----] E, [2017-08-09T10:29:39.930523 #14582:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5367195], timed out after 600.004488991 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T10:29:42.620765 #14582:12a113c] ERROR -- : MIQ(MiqGenericWorker::Runner) ID [1907] PID [14582] GUID [84dd28fa-7d00-11e7-893a-001a4a223911] Exiting worker due to timeout error Worker exiting.
[----] E, [2017-08-09T10:44:41.934629 #9318:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5382381], timed out after 600.003381355 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T10:44:47.115840 #9318:12a113c] ERROR -- : MIQ(MiqGenericWorker::Runner) ID [1885] PID [9318] GUID [07dc85e4-7cf6-11e7-893a-001a4a223911] Exiting worker due to timeout error Worker exiting.
[----] E, [2017-08-09T13:29:43.619405 #21777:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5472358], timed out after 600.001760137 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T13:29:43.705514 #21777:12a113c] ERROR -- : MIQ(MiqGenericWorker::Runner) ID [1961] PID [21777] GUID [33adbbe8-7d0f-11e7-893a-001a4a223911] Exiting worker due to timeout error Worker exiting.
[----] E, [2017-08-09T13:29:53.622064 #2759:12a113c] ERROR -- : MIQ(MiqServer#validate_worker) Worker [MiqGenericWorker] with ID: [1961], PID: [21777], GUID: [33adbbe8-7d0f-11e7-893a-001a4a223911] has not responded in 610.012515689 seconds, restarting worker

Able to extract message IDs, but the last number is wrong. (21777)

$ grep ERROR evm.log | sed -n -e 's#^.*[Message id|\ ID]: \[\(.*\)\],.*#\1#p'
# OR 
$ sed -n -e 's#^.*ERROR.*[Message id|\ ID]: \[\(.*\)\],.*#\1#p' evm.log
5246422
5367195
5382381
5472358
21777

I wanted number corresponding to ID in ID: [1961], PID: [21777], rather than the one shown in output above.

Also, here's an egrep version of this, to find out why this is happening (because of that greedy .*):

$ egrep -w 'ERROR.*(Message id| ID): \[.+\],' evm.log
[----] E, [2017-08-09T08:44:32.927049 #3104:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5246422], timed out after 600.004238745 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T10:29:39.930523 #14582:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5367195], timed out after 600.004488991 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T10:44:41.934629 #9318:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5382381], timed out after 600.003381355 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T13:29:43.619405 #21777:12a113c] ERROR -- : MIQ(MiqQueue#deliver) Message id: [5472358], timed out after 600.001760137 seconds.  Timeout threshold [600]
[----] E, [2017-08-09T13:29:53.622064 #2759:12a113c] ERROR -- : MIQ(MiqServer#validate_worker) Worker [MiqGenericWorker] with ID: [1961], PID: [21777], GUID: [33adbbe8-7d0f-11e7-893a-001a4a223911] has not responded in 610.012515689 seconds, restarting worker

this might help https://jex.im/regulex/

sed -n -e 's#^.*ERROR.*Message id: \[\(.*\)\],.*#\1#p' -e 's#^.*ERROR.* ID: \[\(.*\)\], PID.*#\1#p' evm.log