Group gPatSyslogPRI(?'gPatSyslogPRI'<\d+>) <the literal < (6010 / 748 / 3C16)
\d+a digit, repeated at least once
>the literal > (6210 / 768 / 3E16)
the literal ↵ (1010 / 128 / A16)
Group gPatMesgBody(?'gPatMesgBody'.*) .*any character (except for line terminators), repeated any number of times
the literal ↵ (1010 / 128 / A16)
Group gPatMesgBodyMin(?'gPatMesgBodyMin'.*?) .*?any character (except for line terminators), repeated any number of times
the literal ↵ (1010 / 128 / A16)
Group gPatSyslogNGHeader(?'gPatSyslogNGHeader'\w{3}\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) \w{3}any word character, repeated exactly 3 times
\s+any whitespace character, repeated at least once
\d{1,2}a digit, repeated between 1 and 2 times
\sany whitespace character
\d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
\sany whitespace character
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
the literal ↵ (1010 / 128 / A16)
Group gPatMon(?'gPatMon'Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec|\d{1,2}) Janthe literal text Jan (case sensitive) Febthe literal text Feb (case sensitive) Marthe literal text Mar (case sensitive) Aprthe literal text Apr (case sensitive) Maythe literal text May (case sensitive) Junthe literal text Jun (case sensitive) Julthe literal text Jul (case sensitive) Augthe literal text Aug (case sensitive) Septhe literal text Sep (case sensitive) Octthe literal text Oct (case sensitive) Novthe literal text Nov (case sensitive) Decthe literal text Dec (case sensitive) \d{1,2}a digit, repeated between 1 and 2 times
the literal ↵ (1010 / 128 / A16)
Group gPatMonNum(?'gPatMonNum'\d{1,2}) \d{1,2}a digit, repeated between 1 and 2 times
the literal ↵ (1010 / 128 / A16)
Group gPatDay(?'gPatDay'\d{1,2}) \d{1,2}a digit, repeated between 1 and 2 times
the literal ↵ (1010 / 128 / A16)
Group gPatTime(?'gPatTime'\d{1,2}:\d{1,2}:\d{1,2}) \d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
the literal ↵ (1010 / 128 / A16)
Group gPatYear(?'gPatYear'\d{2,4}) \d{2,4}a digit, repeated between 2 and 4 times
the literal ↵ (1010 / 128 / A16)
Group gPatMSec(?'gPatMSec'\d{1,3}) \d{1,3}a digit, repeated between 1 and 3 times
the literal ↵ (1010 / 128 / A16)
Group gPatTimeMSec(?'gPatTimeMSec'\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) \d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
:the literal : (5810 / 728 / 3A16)
\d{1,2}a digit, repeated between 1 and 2 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
the literal ↵ (1010 / 128 / A16)
Group gPatTimeZone(?'gPatTimeZone'Z|UTC|[+-]\d{1,2}:?\d{2}) 3rd Alternative[+-]\d{1,2}:?\d{2}
the literal ↵ (1010 / 128 / A16)
Group gPatWeekday(?'gPatWeekday'Mon|Tue|Wed|Thu|Fri|Sat|Sun)
the literal ↵ (1010 / 128 / A16)
Group gPatIpV4Dot(?'gPatIpV4Dot'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
the literal ↵ (1010 / 128 / A16)
Group gPatIpAddr(?'gPatIpAddr'[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4}){1,5}:(?:\d{1,3}(?:\.\d{1,3}){3}|[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4})?)|\d{1,3}(?:\.\d{1,3}){3})
the literal ↵ (1010 / 128 / A16)
Group gPatIpPort(?'gPatIpPort'\d{1,5})
the literal ↵ (1010 / 128 / A16)
Group gPatProto(?'gPatProto'ftp|icmp|tcp|udp|http|ip|smb|smtp|snmp|others|FTP|ICMP|UDP|TCP|HTTP|IP|SMB|SMTP|SNMP|OTHERS)
the literal ↵ (1010 / 128 / A16)
Group gPatFqdn(?'gPatFqdn'\w+[.\w+]+)
the literal ↵ (1010 / 128 / A16)
Group gPatWord(?'gPatWord'\w+)
the literal ↵ (1010 / 128 / A16)
Group gPatStr(?'gPatStr'[^\s]*)
the literal ↵ (1010 / 128 / A16)
Group gPatHostName(?'gPatHostName'[\w.-]+)
the literal ↵ (1010 / 128 / A16)
Group gPatStrComma(?'gPatStrComma'[^,]*)
the literal ↵ (1010 / 128 / A16)
Group gPatStrLeftParen(?'gPatStrLeftParen'[^\(]*)
the literal ↵ (1010 / 128 / A16)
Group gPatStrRightSB(?'gPatStrRightSB'[^\]]*)
the literal ↵ (1010 / 128 / A16)
Group gPatInt(?'gPatInt'\d+)
the literal ↵ (1010 / 128 / A16)
Group gPatSpace(?'gPatSpace'\s+)
the literal ↵ (1010 / 128 / A16)
Group gPatStrEndColon(?'gPatStrEndColon'[^:]*)
the literal ↵ (1010 / 128 / A16)
Group gPatStrSQ(?'gPatStrSQ'[^']*)
the literal ↵ (1010 / 128 / A16)
Group gPatStrDQ(?'gPatStrDQ'[^']*)
the literal ↵ (1010 / 128 / A16)
Group gPatSentence(?'gPatSentence'\w[\s+\w]*) g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string