regex101: Regex para Logs de Kiwi Log Forwarder

Explanation

Pro

Group FechayHora(?P<FechayHora>(?:20[0-9]{2}-[0-1]\d-[0-2]\d)\s(?:(?:[0-1]\d|2[0-3]):){2}(?:[0-1]\d|2[0-3]))

Non-Capturing Group(?:20[0-9]{2}-[0-1]\d-[0-2]\d)

20the literal text 20

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Character Class[0-1]

0-1one character from 0 (48₁₀) to 1 (49₁₀)

\da Unicode decimal digit

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Character Class[0-2]

0-2one character from 0 (48₁₀) to 2 (50₁₀)

\da Unicode decimal digit

\sa Unicode whitespace character

Non-Capturing Group(?:(?:[0-1]\d|2[0-3]):){2}

{2}repeats the group contents below exactly 2 times:

Non-Capturing Group(?:[0-1]\d|2[0-3])

1st Alternative[0-1]\d

Character Class[0-1]

0-1one character from 0 (48₁₀) to 1 (49₁₀)

\da Unicode decimal digit

2nd Alternative2[0-3]

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-3]

0-3one character from 0 (48₁₀) to 3 (51₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Non-Capturing Group(?:[0-1]\d|2[0-3])

1st Alternative[0-1]\d

Character Class[0-1]

0-1one character from 0 (48₁₀) to 1 (49₁₀)

\da Unicode decimal digit

2nd Alternative2[0-3]

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-3]

0-3one character from 0 (48₁₀) to 3 (51₁₀)

Non-Capturing Group(?:,|\s)

1st Alternative,

,the literal , (44₁₀ / 54₈ / 2C₁₆)

2nd Alternative\s

\sa Unicode whitespace character

Group LogLevel(?P<LogLevel>(?:\w*\.?\w*))

Non-Capturing Group(?:\w*\.?\w*)

\w*a Unicode word character, repeated any number of times

\.?optionally matches the literal . (46₁₀ / 56₈ / 2E₁₆)

\w*a Unicode word character, repeated any number of times

Non-Capturing Group(?:,|\s)

1st Alternative,

,the literal , (44₁₀ / 54₈ / 2C₁₆)

2nd Alternative\s

\sa Unicode whitespace character

Group Hostname(?P<Hostname>(?:\d{1,3}\.){3}\d{1,3}|(?:\w*\.cerrey\.com\.mx))

1st Alternative(?:\d{1,3}\.){3}\d{1,3}

2nd Alternative(?:\w*\.cerrey\.com\.mx)

Non-Capturing Group(?:,|\s)

Group mensaje(?P<mensaje>\"?[\w\s:,\[\]()/-]*\"?)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Quick Reference

25 tokens

Regular Expression

(?P<FechayHora>(?:20[0-9]{2}-[0-1]\d-[0-2]\d)\s(?:(?:[0-1]\d|2[0-3]):){2}(?:[0-1]\d|2[0-3]))(?:,|\s)(?P<LogLevel>(?:\w*\.?\w*))(?:,|\s)(?P<Hostname>(?:\d{1,3}\.){3}\d{1,3}|(?:\w*\.cerrey\.com\.mx))(?:,|\s)(?P<mensaje>\"?[\w\s:,\[\]()/-]*\"?)

2023-05-21 00:00:00,Daemon.Info,172.16.1.247,May 21 00:40:01 flex3 systemd: Created slice User Slice of root.
2023-05-21 00:00:00,Daemon.Info,MTYDC02.cerrey.com.mx,May 21 00:40:01 flex3 systemd: Starting User Slice of root.
2023-05-21 00:00:00,Daemon.Info,172.16.1.247,May 21 00:40:01 flex3 systemd: Started Session 2782 of user root.
2023-05-21 00:00:00,Daemon.Info,172.16.1.247,May 21 00:40:01 flex3 systemd: Starting Session 2782 of user root.
2023-05-21 00:00:00,Cron.Info,172.16.1.247,May 21 00:40:01 flex3 CROND[23978]: (root) CMD (/usr/lib64/sa/sa1 1 1)
2023-05-21 00:00:00,Daemon.Info,172.16.1.247,May 21 00:40:01 flex3 systemd: Removed slice User Slice of root.
2023-05-21 00:00:00,Daemon.Info,172.16.1.247,May 21 00:40:01 flex3 systemd: Stopping User Slice of root.
2023-05-21 00:00:01,System3.Critical,MTYSYSLOG.cerrey.com.mx,may 21 00:00:01 MTYSYSLOG.cerrey.com.mx MSWinEventLog	2	Security	10337	dom may 21 00:00:00 2023	4673	Microsoft-Windows-Security-Auditing		N/A	Audit Failure	MTYSYSL