Regular Expressions 101

Explanation

Pro

^start of line

Group time(?<time>[^ +][-:0-9TZ]+|[[:upper:]][[:lower:]]{2}[ -:+0-9TZ]*)

1st Alternative[^ +][-:0-9TZ]+

Negated Character Class[^ +]

the literal (32₁₀ / 40₈ / 20₁₆)

+the literal + (43₁₀ / 53₈ / 2B₁₆)

Character Class[-:0-9TZ]+

+matches at least one character from the set below:

-the literal - (45₁₀ / 55₈ / 2D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Tthe literal T (84₁₀ / 124₈ / 54₁₆) (case sensitive)

Zthe literal Z (90₁₀ / 132₈ / 5A₁₆) (case sensitive)

2nd Alternative[[:upper:]][[:lower:]]{2}[ -:+0-9TZ]*

Character Class[[:upper:]]

[:upper:]an uppercase letter [A-Z]

Character Class[[:lower:]]{2}

{2}matches exactly 2 characters from the set below:

[:lower:]a lowercase letter [a-z]

Character Class[ -:+0-9TZ]*

*matches any number of characters from the set below:

-:one character from (32₁₀) to : (58₁₀)

+the literal + (43₁₀ / 53₈ / 2B₁₆)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Tthe literal T (84₁₀ / 124₈ / 54₁₆) (case sensitive)

Zthe literal Z (90₁₀ / 132₈ / 5A₁₆) (case sensitive)

Group 2([^ ][+0:]+|\s+)

1st Alternative[^ ][+0:]+

Negated Character Class[^ ]

the literal (32₁₀ / 40₈ / 20₁₆)

Character Class[+0:]+

+matches at least one character from the set below:

+the literal + (43₁₀ / 53₈ / 2B₁₆)

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

2nd Alternative\s+

\s+any whitespace character, repeated at least once

Group 3(\s*)

\s*any whitespace character, repeated any number of times

Group host(?<host>[^ ][-\w\d]+)

Negated Character Class[^ ]

the literal (32₁₀ / 40₈ / 20₁₆)

Character Class[-\w\d]+

+matches at least one character from the set below:

-the literal - (45₁₀ / 55₈ / 2D₁₆)

\wany word character

\da digit

Group 5(\s*)

\s*any whitespace character, repeated any number of times

Group service(?<service>[^ [][-_\w]+)

Negated Character Class[^ []

the literal (32₁₀ / 40₈ / 20₁₆)

[the literal [ (91₁₀ / 133₈ / 5B₁₆)

Character Class[-_\w]+

+matches at least one character from the set below:

-the literal - (45₁₀ / 55₈ / 2D₁₆)

_the literal _ (95₁₀ / 137₈ / 5F₁₆)

\wany word character

Group 7(\[(?<pid>[^ \]][\d]*)\])

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

Group pid(?<pid>[^ \]][\d]*)

Negated Character Class[^ \]]

the literal (32₁₀ / 40₈ / 20₁₆)

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

Character Class[\d]*

*matches any number of characters from the set below:

\da digit

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\s*any whitespace character, repeated any number of times

Group 9((\[\s*(?<mtime>[^ ][\w: \/]+)\]\s*\[\s*(?<severity>[^ ][\w]+)\]\s*){0,1}\s*\[\s*(?<component>[^ ][\w:]+)\]){0,1}

\s*any whitespace character, repeated any number of times

Group message(?<message>.*){0,1}

.*any character (except for line terminators), repeated any number of times

$end of line

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

x modifier: extended. Ignores unescaped whitespace and comments outside character classes

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Match Information

Detailed match information will be displayed here automatically.

Quick Reference

25 tokens

Regular Expression

^(?<time>[^ +][-:0-9TZ]+|[[:upper:]][[:lower:]]{2}[ -:+0-9TZ]*)([^ ][+0:]+|\s+)(\s*)(?<host>[^ ][-\w\d]+)(\s*)(?<service>[^ [][-_\w]+)(\[(?<pid>[^ \]][\d]*)\]):\s*((\[\s*(?<mtime>[^ ][\w: \/]+)\]\s*\[\s*(?<severity>[^ ][\w]+)\]\s*){0,1}\s*\[\s*(?<component>[^ ][\w:]+)\]){0,1}\s*(?<message>.*){0,1}.*$

New

Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3915] haproxy: [1503580119.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:08:39", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3916] haproxy: [1503580148.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:08", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3917] haproxy: [1503580151.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:11", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3918] haproxy: [1503580164.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:24", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911

Extraction

Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3915] haproxy: [1503580119.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:08:39", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3916] haproxy: [1503580148.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:08", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3917] haproxy: [1503580151.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:11", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3918] haproxy: [1503580164.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:24", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911