AWK not able to extract the from field in the maillog

I am trying to extract some fields from the maillog and it worked fine except this below message when it failed.

May 10 07:15:04 chitraak sendmail[8558]: 34ABF4Kb008569: from=<"dexter prod" <dexter_noreply@au.edu>>, size=452, class=0, nrcpts=1, msgid=<202305101115.34ABF4Kb946558@chitraak.abc.com>, proto=ESMTP, daemon=MTA, relay=ip-192-68-1-4.ec2.internal [1.2.3.4]

Now when I perform awk it gives me below output

cat email | awk '{print $7 " " $NF}'
from=<"dexter [1.2.3.4]

Now all email addresses are in format from=<abc@xyz.com>. Only this message has custom name first and then the email addresses. Can some one tell one unifying regex that will work for above text and rest of the messages as well.

Desired output

from=<"dexter prod" <dexter_noreply@au.edu>> [1.2.3.4]

Since rest of messages does not have spaces in from=<"email"> , that's why my awk commands work for those messages. It fails to extract when there is space involved. Also the regex that will give the above output should also work for rest of messages that have there from field set in format from=<dexter_noreply@au.edu

So let's say there are two messages with different formats like below.

May 10 07:15:04 chitraak sendmail[8558]: 34ABF4Kb008569: from=<"dexter prod" <dexter_noreply@au.edu>>, size=452, class=0, nrcpts=1, msgid=<202305101115.34ABF4Kb946558@chitraak.abc.com>, proto=ESMTP, daemon=MTA, relay=ip-192-68-1-4.ec2.internal [1.2.3.4]
May 10 07:15:04 chitraak sendmail[8558]: 34ABF4Kb008569: from=<dexter_noreply@au.edu>, size=452, class=0, nrcpts=1, msgid=<202305101115.34ABF4Kb946558@chitraak.abc.com>, proto=ESMTP, daemon=MTA, relay=ip-192-68-1-4.ec2.internal [1.2.3.5]

The desired output after implementing the regex should be like below

from=<"dexter prod" <dexter_noreply@au.edu>> [1.2.3.4]
from=<dexter_noreply@au.edu> [1.2.3.4]

Is it possible or do I need to capture these as two separate regex ?

Using GNU awk:

no need to pipe cat | awk, it's a UUOC aka Useless Use Of Cat

awk 'BEGIN{FPAT="from=.*>>"}{print $1}' file
from=<"dexter prod" <dexter_noreply@au.edu>>

See splitting by content

With grep:

grep -oE 'from=.*?>>' file
from=<"dexter prod" <dexter_noreply@au.edu>>

With sed:

sed -E 's/.*(from=.*?>>).*//' file
from=<"dexter prod" <dexter_noreply@au.edu>>

With Perl:

perl -nE 'say $& if /from=.*?>>/' file
from=<"dexter prod" <dexter_noreply@au.edu>>

1st solution: With using awk's match function please try following solution. Using regex : from=<"[^>]*>> to get the exact required output by OP. If a match of regex is Found then printing the matched values by sub-string.

awk 'match($0,/: from=<"[^>]*>>/){print substr($0,RSTART+2,RLENGTH-2)}' Input_file

2nd solution: Using sed with E option please try following.

sed -E 's/^.*: (from=<"[^>]*>>).*$//' Input_file

3rd solution: Using GNU grep with regex and using \K option to forget the match while printing use following code.

grep -oP '^.*: \Kfrom=<"[^>]*>>' Input_file

4th solution: Using GNU awk with its RS and RT capabilities try following.

awk -v RS=': from=<"[^>]*>>' '
RT && split(RT,arr,": "){
  print arr[2]
}
' Input_file

5th solution: Using simple field separators with your shown samples only.

awk -F': |, ' '{print $3}' Input_file

It's probably safe to use the comma to mark the end of the from= field:

awk 'match($0,/from=[^,]*/) { print substr($0,RSTART,RLENGTH), $NF }'

from=<"dexter prod" <dexter_noreply@au.edu>> [1.2.3.4]
from=<dexter_noreply@au.edu> [1.2.3.5]

> mawk 'BEGIN { ORS = sprintf("%.*s\n",+= ++,RS = ">>[^\n]+\n")
> FS = ".+ " (OFS = "from=") } NF = _'

from=<"dexter prod" <dexter_noreply@au.edu>>

a less regex more hard-coded in way would be

> gawk '$(NF = !_ + ($!_ = "from")^_) = $2 ">>"' FS='=|>>.+$' OFS==

from=<"dexter prod" <dexter_noreply@au.edu>>

This GNU sed should work for both the cases :

sed -E 's/.*(from=.*>.*), size=.* (\[.*\])$///' file

Using any sed:

$ sed 's/.*\(from=[^,]*\).* / /' email
from=<"dexter prod" <dexter_noreply@au.edu>> [1.2.3.4]
from=<dexter_noreply@au.edu> [1.2.3.5]