Regular Expressions 101

Explanation

Pro

.*?any character (except for line terminators), repeated any number of times

{"EVENT_NAME":"the literal text {"EVENT_NAME":" (case sensitive)

Group tag6(?<tag6>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","EVENT_ID":"the literal text ","EVENT_ID":" (case sensitive)

Group action(?<action>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","User_Id":"the literal text ","User_Id":" (case sensitive)

Group login(?<login>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","X_Corelation_ID":"the literal text ","X_Corelation_ID":" (case sensitive)

Group policy(?<policy>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","Client_IPAddress":"the literal text ","Client_IPAddress":" (case sensitive)

Group sip(?<sip>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","Acting_As_ID":"the literal text ","Acting_As_ID":" (case sensitive)

Group account(?<account>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

","Message":"the literal text ","Message":" (case sensitive)

Group tag2(?<tag2>[^"]*)

Negated Character Class[^"]*

*matches any number of characters outside the set below:

"the literal " (34₁₀ / 42₈ / 22₁₆)

"}the literal text "}

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Match Information

Detailed match information will be displayed here automatically.

Quick Reference

25 tokens

Regular Expression

.*?{"EVENT_NAME":"(?<tag6>[^"]*)","EVENT_ID":"(?<action>[^"]*)","User_Id":"(?<login>[^"]*)","X_Corelation_ID":"(?<policy>[^"]*)","Client_IPAddress":"(?<sip>[^"]*)","Acting_As_ID":"(?<account>[^"]*)","Message":"(?<tag2>[^"]*)"}

New

[2019-01-15 13:44:43,432] [[ACTIVE] ExecuteThread: '45' for queue: 'weblogic.kernel.Default (self-tuning)'] WARN  SiemLogger - {"EVENT_NAME":"SIEM","EVENT_ID":"LOGOUT","User_Id":"ROBKNT1810","X_Corelation_ID":"null","Client_IPAddress":"null","Acting_As_ID":"null","Message":"MobileSignOutPage - User successfully logged out."}

Extraction

[2019-01-15 13:44:43,432] [[ACTIVE] ExecuteThread: '45' for queue: 'weblogic.kernel.Default (self-tuning)'] WARN  SiemLogger - {"EVENT_NAME":"SIEM","EVENT_ID":"LOGOUT","User_Id":"ROBKNT1810","X_Corelation_ID":"null","Client_IPAddress":"null","Acting_As_ID":"null","Message":"MobileSignOutPage - User successfully logged out."}