Подскажите регексу

< log.txt awk -vFPAT='[^][]+' '$5~/Session UP/ { start=$1; } $5~/Session Down/ {print start " | " $1 " | " $4 " | " $5}'
2025-06-12 10:32:15.142 | 2025-06-12 10:40:15.142 | xxx |  Session Down by KAPEC
2025-06-12 12:32:15.142 | 2025-06-12 12:40:15.142 | yyy |  Session Down by KABZDEC
2025-06-12 13:32:15.142 | 2025-06-12 13:40:15.142 | zzz |  Session Down by PIPEC

>>> (dt.datetime.fromisoformat('2025-06-12 10:32:15.142') - dt.datetime.fromisoformat('2025-06-12 10:40:15.142')).seconds
85920

[2025-06-12 10:32:15.142][INFO][1][xxx] Session UP
[2025-06-12 11:32:15.142][INFO][1][yyy] Session UP
[2025-06-12 12:32:15.142][INFO][1][xxx] Session Down by KAPEC
[2025-06-12 13:32:15.142][INFO][1][zzz] Session UP
[2025-06-12 14:32:15.142][INFO][1][yyy] Session Down by KABZDEC
[2025-06-12 15:32:15.142][INFO][1][zzz] Session Down by PIPEC

#!/usr/bin/env perl

use strict;
use warnings;

my $rx_item = qr{
                \[       # opening bracket
                ([^\]]*) # captured value
                \]       # closing bracket
              }x;
my $rx_log_prefix = $rx_item x4;

my %sessions;

while(<>) {
    chomp;
    if (/Session UP$/) {
        my ($start_datetime, undef, undef, $id) = /^$rx_log_prefix/;
        warn "Session $id is already UP - overwriting"
            if exists $sessions{$id};
        $sessions{$id} = { start_datetime => $start_datetime };
    } elsif (/Session Down/) {
        warn "Missing reason" unless /by (.*)$/;
        my $reason = $1;
        my ($end_datetime, undef, undef, $id) = /^$rx_log_prefix/;
        warn "Session $id is down but no UP message found"
            unless exists $sessions{$id};
        my $start_datetime = $sessions{$id}{start_datetime};
        print "$id | $start_datetime | $end_datetime | $reason\n";
        delete $sessions{$id};
    }
}

$ ./pipec.pl t
xxx | 2025-06-12 10:32:15.142 | 2025-06-12 10:40:15.142 | KAPEC
yyy | 2025-06-12 12:32:15.142 | 2025-06-12 12:40:15.142 | KABZDEC
zzz | 2025-06-12 13:32:15.142 | 2025-06-12 13:40:15.142 | PIPEC

Use of uninitialized value $id in hash element at ./s.pl line 28, <> line 25987.
Use of uninitialized value $id in concatenation (.) or string at ./s.pl line 29, <> line 25987.
Use of uninitialized value $start_datetime in concatenation (.) or string at ./s.pl line 29, <> line 25987.
Use of uninitialized value $end_datetime in concatenation (.) or string at ./s.pl line 29, <> line 25987.
 |  |  | DTLS alert(warning CN), username=9d2t68gt:8MoR
Use of uninitialized value $id in delete at ./s.pl line 30, <> line 25987.
Use of uninitialized value $id in exists at ./s.pl line 27, <> line 30111.

/Session/ && match($0, /\[(.+)\]/, a) {
    match($0, /\[1\]\[(.+)\] Session/, session)
    session_id = session[1]
    split(a[1], t, "[-:. ]");
    log_time = mktime(t[1]" "t[2]" "t[3]" "t[4]" "t[5]" "t[6]) + t[7]/1000
    human_time = strftime("%Y-%m-%d %H:%M:%S", log_time)
    if ($4 == "UP") {
        sessions[session_id] = log_time
        sessions_start[session_id] = human_time
    } else {
        printf("%s\t%s\t%d\t%s\n", session_id, sessions_start[session_id], log_time - sessions[session_id], $NF)
    }
}

$ journalctl --no-pager | awk -f session.awk
xxx     2025-06-12 10:32:15     480     KAPEC
yyy     2025-06-12 12:32:15     480     KABZDEC
zzz     2025-06-12 13:32:15     480     PIPEC

$ cat file.log | 
sed -n 's@^\[\([^ ]*\) \([^]]*\)]\[INFO]\[[^]]*]\[\([^]]*\)] Session \(UP\|Down by \(.*\)\)$@\3 \1T\2 \5@p' | 
sort -k1,1 | 
while read SESSION TIME REASON; do 
  TIME="${TIME%.*}"; 
  TIME_S="$( date -d "$TIME" +%s )"; 
  if [[ -z "$REASON" ]]; then 
    START="$TIME"; 
    START_S="$TIME_S"; 
  else 
    DURATION="$( bc <<< "$TIME_S - $START_S" )"; 
    echo "$SESSION $START $DURATION $REASON"; 
  fi; 
done

ssam -e 'x/^\[[^\]]*\]/ y/\[|\]/ g/./ |date -j -f "%Y-%m-%d %H:%M:%S" "$(cat)" "+%s" |tr -d "\n"' |
ssam -e '{
	d
	x g/Session +UP/ {
		-#0+/\[[^\]]*\]/+//+//+// y/\[|\]/ g/./ {
			t $
			$ a| / |
		}
		-#0+/\[[^\]]*\]/ y/\[|\]/ g/./ {
			t $
			$ a| / |
			t $
			$ a/-/
		}
		/Session +Down/-+ {
			-#0+/\[[^\]]*\]/ y/\[|\]/ g/./ {
				t $
				$ a| / |
			}
			+#0-/[a-zA-Z_0-9]*/ {
				t $
				$ a/\n/
			}
		}
	}
}' |
ssam -e 'x {
	-#0+/[0-9]+/ |date -j -f "%s" "$(cat)" "+%Y-%m-%d %H:%M:%S" |tr -d "\n"
	-#0+/[0-9]+-[0-9]+/ |echo "-($(cat))" |bc |tr -d "\n"
}'