regex101: PCRE (Legacy) Match Workspace

^start of line

Group current_time(?<current_time>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

\d+a digit, repeated at least once

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\d+a digit, repeated at least once

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

Group transfer_time(?<transfer_time>\d+)

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

Group remote_host(?<remote_host>\d+\.\d+\.\d+\.\d+)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

Group file_size(?<file_size>\d+)

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

Group file_path(?<file_path>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\s+any whitespace character, repeated at least once

Group transfer_mode(?<transfer_mode>\w+)

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

Group transfer_security(?<transfer_security>\w+)

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

Group transfer_status(?<transfer_status>\w+)

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

Group access_mode(?<access_mode>\w+)

\w+any word character, repeated at least once

\s+any whitespace character, repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

^(?<current_time>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+(?<transfer_time>\d+)\s+(?<remote_host>\d+\.\d+\.\d+\.\d+)\s+(?<file_size>\d+)\s+(?<file_path>[^ ]+)\s+(?<transfer_mode>\w+)\s+(?<transfer_security>\w+)\s+(?<transfer_status>\w+)\s+(?<access_mode>\w+)\s+

New

Mon Nov 23 09:21:57 2020 6 10.0.0.3 3783 /root/A/P2/source1/POL.IDM b s i r kumar ssh 0 *

Mon Nov 23 09:21:58 2020 5 10.0.0.4 3783 /root/A/P2/.stfs/objects/8a/32bcb75c884c00175c989636000ba/b14fbda4-6857-4910-9a74-9789b6165b7f/52925c56-3ae2-4f75-bb3a-97622e9223b0/8a332bcb75c884c00175c989751500c3/POL.IDM b n o r kumar ssh 0 *

Mon Nov 23 09:15:25 2020 7 10.0.0.2 68 /root/A/P1/.stfs/objects/8a/325cc74705abd017472f907ce0155/12763075-66b1-4a1b-b080-0c5d0a5a0c11/d8c5486a-57ab-4798-a8cc-2bf45f3b975b/8a3325cc74705abd017472f9bbc701c7/WEB.dat a s o p ftp 0 *

Regular Expressions 101

Regular Expression

Extraction