Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8

Function

  • Match
  • Substitution
  • List
  • Unit Tests
/
^\"(?<timestart>\d{4}\/\d{2}\/\d{2}\s\d{2}\:\d{2}\:\d{2})?([\"|\,]*)?(?<recipient>[\w|\.|\-|_|\d]*@(?<domainimpacted>[\w|\.|\-|_|\d]*))?([\"|\,]*)?(?<subject>[\w|\s|\#|\@|||\d|\!|\$|\%|\^|\,|\.|\(|\)|\[|\]|\{|\}|\:|\-|\&|\*|\'|\=|\+]*)?([\"|\,]*)?(?<action>\w*)?([\"|\,]*)?(?<sender>[\w|\.|\-|_|\d]*@(?<domainorigin>[\w|\.|\-|_|\d]*))?([\"|\,]*)?(?<account>[\w|\.|\-|_|\d|\,|\s]*)?([\"|\,]*)?(?<status>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<object>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<reason>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<policy>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<objecttype>[\w|\.|\-|_|\d|\s|\,]*)?([\"|\,]*)?(?<size>[\d]*)?([\"|\,]*)?(?<command>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<objectname>[\w|\.|\-|_|\d]*)?([\"|\,]*)?(?<threatname>[\w|\.|\-|_|\d]*)?([\"|\,]*)?
/
gm
^ asserts position at start of a line
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
Named Capture Group timestart
(?<timestart>\d{4}\/\d{2}\/\d{2}\s\d{2}\:\d{2}\:\d{2})?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
\d
matches a digit (equivalent to [0-9])
{4} matches the previous token exactly 4 times
\/ matches the character / with index 4710 (2F16 or 578) literally (case sensitive)
\d
matches a digit (equivalent to [0-9])
{2} matches the previous token exactly 2 times
\/ matches the character / with index 4710 (2F16 or 578) literally (case sensitive)
\d
matches a digit (equivalent to [0-9])
{2} matches the previous token exactly 2 times
\s matches any whitespace character (equivalent to [\r\n\t\f\v ])
\d
matches a digit (equivalent to [0-9])
{2} matches the previous token exactly 2 times
\: matches the character : with index 5810 (3A16 or 728) literally (case sensitive)
\d
matches a digit (equivalent to [0-9])
{2} matches the previous token exactly 2 times
\: matches the character : with index 5810 (3A16 or 728) literally (case sensitive)
\d
matches a digit (equivalent to [0-9])
{2} matches the previous token exactly 2 times
2nd Capturing Group
([\"|\,]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\"|\,]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
Named Capture Group recipient
(?<recipient>[\w|\.|\-|_|\d]*@(?<domainimpacted>[\w|\.|\-|_|\d]*))?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\w|\.|\-|_|\d]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
|_|
matches a single character in the list |_ (case sensitive)
\d matches a digit (equivalent to [0-9])
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)
Named Capture Group domainimpacted
(?<domainimpacted>[\w|\.|\-|_|\d]*)
Match a single character present in the list below
[\w|\.|\-|_|\d]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
|_|
matches a single character in the list |_ (case sensitive)
\d matches a digit (equivalent to [0-9])
5th Capturing Group
([\"|\,]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\"|\,]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
Named Capture Group subject
(?<subject>[\w|\s|\#|\@|||\d|\!|\$|\%|\^|\,|\.|\(|\)|\[|\]|\{|\}|\:|\-|\&|\*|\'|\=|\+]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\w|\s|\#|\@|||\d|\!|\$|\%|\^|\,|\.|\(|\)|\[|\]|\{|\}|\:|\-|\&|\*|\'|\=|\+]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\s matches any whitespace character (equivalent to [\r\n\t\f\v ])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\# matches the character # with index 3510 (2316 or 438) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
matches the character ± with index 17710 (B116 or 2618) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
matches the character § with index 16710 (A716 or 2478) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\d matches a digit (equivalent to [0-9])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\! matches the character ! with index 3310 (2116 or 418) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\$ matches the character $ with index 3610 (2416 or 448) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\% matches the character % with index 3710 (2516 or 458) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\^ matches the character ^ with index 9410 (5E16 or 1368) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\( matches the character ( with index 4010 (2816 or 508) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\) matches the character ) with index 4110 (2916 or 518) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\[ matches the character [ with index 9110 (5B16 or 1338) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\] matches the character ] with index 9310 (5D16 or 1358) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\{ matches the character { with index 12310 (7B16 or 1738) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\} matches the character } with index 12510 (7D16 or 1758) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\: matches the character : with index 5810 (3A16 or 728) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\& matches the character & with index 3810 (2616 or 468) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\* matches the character * with index 4210 (2A16 or 528) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\' matches the character ' with index 3910 (2716 or 478) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\= matches the character = with index 6110 (3D16 or 758) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\+ matches the character + with index 4310 (2B16 or 538) literally (case sensitive)
7th Capturing Group
([\"|\,]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\"|\,]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
Named Capture Group action
(?<action>\w*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
\w
matches any word character (equivalent to [a-zA-Z0-9_])
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
9th Capturing Group
([\"|\,]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\"|\,]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
Named Capture Group sender
(?<sender>[\w|\.|\-|_|\d]*@(?<domainorigin>[\w|\.|\-|_|\d]*))?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\w|\.|\-|_|\d]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
|_|
matches a single character in the list |_ (case sensitive)
\d matches a digit (equivalent to [0-9])
@ matches the character @ with index 6410 (4016 or 1008) literally (case sensitive)
Named Capture Group domainorigin
(?<domainorigin>[\w|\.|\-|_|\d]*)
Match a single character present in the list below
[\w|\.|\-|_|\d]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
|_|
matches a single character in the list |_ (case sensitive)
\d matches a digit (equivalent to [0-9])
12th Capturing Group
([\"|\,]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\"|\,]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\" matches the character " with index 3410 (2216 or 428) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
Named Capture Group account
(?<account>[\w|\.|\-|_|\d|\,|\s]*)?
? matches the previous token between zero and one times, as many times as possible, giving back as needed (greedy)
Match a single character present in the list below
[\w|\.|\-|_|\d|\,|\s]
* matches the previous token between zero and unlimited times, as many times as possible, giving back as needed (greedy)
\w matches any word character (equivalent to [a-zA-Z0-9_])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\. matches the character . with index 4610 (2E16 or 568) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\- matches the character - with index 4510 (2D16 or 558) literally (case sensitive)
|_|
matches a single character in the list |_ (case sensitive)
\d matches a digit (equivalent to [0-9])
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\, matches the character , with index 4410 (2C16 or 548) literally (case sensitive)
| matches the character | with index 12410 (7C16 or 1748) literally (case sensitive)
\s matches any whitespace character (equivalent to [\r\n\t\f\v ])
14th Capturing Group
([\"|\,]*)?
Named Capture Group status
(?<status>[\w|\.|\-|_|\d]*)?
16th Capturing Group
([\"|\,]*)?
Named Capture Group object
(?<object>[\w|\.|\-|_|\d]*)?
18th Capturing Group
([\"|\,]*)?
Named Capture Group reason
(?<reason>[\w|\.|\-|_|\d]*)?
20th Capturing Group
([\"|\,]*)?
Named Capture Group policy
(?<policy>[\w|\.|\-|_|\d]*)?
22nd Capturing Group
([\"|\,]*)?
Named Capture Group objecttype
(?<objecttype>[\w|\.|\-|_|\d|\s|\,]*)?
24th Capturing Group
([\"|\,]*)?
Named Capture Group size
(?<size>[\d]*)?
26th Capturing Group
([\"|\,]*)?
Named Capture Group command
(?<command>[\w|\.|\-|_|\d]*)?
28th Capturing Group
([\"|\,]*)?
Named Capture Group objectname
(?<objectname>[\w|\.|\-|_|\d]*)?
30th Capturing Group
([\"|\,]*)?
Named Capture Group threatname
(?<threatname>[\w|\.|\-|_|\d]*)?
32nd Capturing Group
([\"|\,]*)?
Global pattern flags
g modifier: global. All matches (don't return after first match)
m modifier: multi line. Causes ^ and $ to match the begin/end of each line (not only begin/end of string)
Your regular expression does not match the subject string.Try launching the debugger to find out why.

Regular Expression
No Match

/
/
gm

Test String