regex101: PCRE (Legacy) Match Workspace

^start of line

date_time=the literal text date_time= (case sensitive)

Group 1([\d-]+ [\d:]+)

Character Class[\d-]+

+matches at least one character from the set below:

\da digit

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Character Class[\d:]+

+matches at least one character from the set below:

\da digit

:the literal : (58₁₀ / 72₈ / 3A₁₆)

user=the literal text user= (case sensitive)

Group 2(.+?)

.+?any character (except for line terminators), repeated at least once

ip_address=the literal text ip_address= (case sensitive)

Group 3([\d.]+)

Character Class[\d.]+

+matches at least one character from the set below:

\da digit

.the literal . (46₁₀ / 56₈ / 2E₁₆)

origin=the literal text origin= (case sensitive)

Group 4(.+?)

.+?any character (except for line terminators), repeated at least once

action=the literal text action= (case sensitive)

Group 5(.+?)

.+?any character (except for line terminators), repeated at least once

Non-Capturing Group(?: password=((?:(?!\w+=).)*))?

?repeats the group contents below at most once:

password=the literal text password= (case sensitive)

Group 6((?:(?!\w+=).)*)

Non-Capturing Group(?:(?!\w+=).)*

*repeats the group contents below any number of times:

Negative Lookahead(?!\w+=)

\w+any word character, repeated at least once

=the literal = (61₁₀ / 75₈ / 3D₁₆)

.any character (except for line terminators)

Non-Capturing Group(?: project=((?:(?!\w+=).)*))?

?repeats the group contents below at most once:

project=the literal text project= (case sensitive)

Group 7((?:(?!\w+=).)*)

Non-Capturing Group(?:(?!\w+=).)*

*repeats the group contents below any number of times:

Negative Lookahead(?!\w+=)

\w+any word character, repeated at least once

=the literal = (61₁₀ / 75₈ / 3D₁₆)

.any character (except for line terminators)

Non-Capturing Group(?: additional=(.+?))?

?repeats the group contents below at most once:

additional=the literal text additional= (case sensitive)

Group 8(.+?)

.+?any character (except for line terminators), repeated at least once

$end of line

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

^date_time=([\d-]+ [\d:]+) user=(.+?) ip_address=([\d.]+) origin=(.+?) action=(.+?)(?: password=((?:(?!\w+=).)*))?(?: project=((?:(?!\w+=).)*))?(?: additional=(.+?))?$

New

date_time=2017-01-27 23:29:06 user=John Doe (86) ip_address=10.10.44.131 origin=web action=add_password password=Non-ACS Devices (1099) project=Infrastructure & Operations (31) additional=Import

date_time=2017-01-27 23:17:39 user=John Doe (86) ip_address=10.10.44.131 origin=web action=export password=CSDEV - SQL Account #20 (496) project=Applications (2)
date_time=2017-01-30 18:21:49 user=John Doe (86) ip_address=10.10.44.131 origin=web action=view_passwords_list additional=Active Passwords
date_time=2017-01-27 23:29:06 user=John Doe (86) ip_address=10.10.44.131 origin=web action=add_password password=Non-ACS Devices (1099) project=Infrastructure & Operations (31) additional=Import

Regular Expressions 101

Regular Expression

Extraction