regex101: PCRE (Legacy) Match Workspace

tcpthe literal text tcp (case sensitive)

\hany horizontal whitespace character

.*?any character (except for line terminators), repeated any number of times

:80the literal text :80

\hany horizontal whitespace character

.*?any character (except for line terminators), repeated any number of times

\ban ASCII word boundary

users:the literal text users: (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

"the literal " (34₁₀ / 42₈ / 22₁₆)

\Kresets the starting point of the reported match. Any previously consumed characters are no longer included in the final match

Negated Character Class[^"]+

+matches at least one character outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

Positive Lookahead(?=")

"the literal " (34₁₀ / 42₈ / 22₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

tcp\h.*?:80\h.*?\busers:\(\("\K[^"]+(?=")

New

tcp    LISTEN   0        10                0.0.0.0:80          0.0.0.0:*    users:(("nc",pid=3474,fd=4))          
tcp    LISTEN   0        10                   [::]:80             [::]:*    users:(("nc",pid=3474,fd=3))  


tcp   LISTEN 0      511                 *:80              *:*    users:(("apache2",pid=6741,fd=4),("apache2",pid=6740,fd=4),("apache2",pid=6738,fd=4),("apache2",pid=6737,fd=4),("apache2",pid=6736,fd=4),("apache2",pid=6724,fd=4))

Substitution

tcp    LISTEN   0        10                0.0.0.0:80          0.0.0.0:*    users:(("nc",pid=3474,fd=4))          
tcp    LISTEN   0        10                   [::]:80             [::]:*    users:(("nc",pid=3474,fd=3))  


tcp   LISTEN 0      511                 *:80              *:*    users:(("apache2",pid=6741,fd=4),("apache2",pid=6740,fd=4),("apache2",pid=6738,fd=4),("apache2",pid=6737,fd=4),("apache2",pid=6736,fd=4),("apache2",pid=6724,fd=4))