regex101: PCRE (Legacy) Match Workspace

Group timestamp(?P<timestamp>[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9A-Z]+)

Character Class[0-9]{4}

{4}matches exactly 4 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Tthe literal T (84₁₀ / 124₈ / 54₁₆) (case sensitive)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

.any character (except for line terminators)

Character Class[0-9A-Z]+

+matches at least one character from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

the literal (32₁₀ / 40₈ / 20₁₆)

Group elbName(?P<elbName>[a-zA-Z-]+)

Character Class[a-zA-Z-]+

+matches at least one character from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group clientPort(?P<clientPort>[0-9.:]+)

Character Class[0-9.:]+

+matches at least one character from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

.the literal . (46₁₀ / 56₈ / 2E₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group backendPort(?P<backendPort>[0-9.:]+)

Character Class[0-9.:]+

+matches at least one character from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

.the literal . (46₁₀ / 56₈ / 2E₁₆)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group request_processing_time(?P<request_processing_time>[.0-9-]+)

Character Class[.0-9-]+

+matches at least one character from the set below:

.the literal . (46₁₀ / 56₈ / 2E₁₆)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group response_processing_time(?P<response_processing_time>[.0-9]+)

Character Class[.0-9]+

+matches at least one character from the set below:

.the literal . (46₁₀ / 56₈ / 2E₁₆)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

the literal (32₁₀ / 40₈ / 20₁₆)

Group elb_status_code(?P<elb_status_code>[.0-9-]+)

Character Class[.0-9-]+

+matches at least one character from the set below:

.the literal . (46₁₀ / 56₈ / 2E₁₆)

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group backend_status_code(?P<backend_status_code>[0-9-]+)

Character Class[0-9-]+

+matches at least one character from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group received_bytes(?P<received_bytes>[0-9-]+)

Character Class[0-9-]+

+matches at least one character from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

the literal (32₁₀ / 40₈ / 20₁₆)

Group sent_bytes(?P<sent_bytes>[0-9-]+)

Character Class[0-9-]+

the literal (32₁₀ / 40₈ / 20₁₆)

Group request(?P<request>[0-9-]+)

"the literal text "

Group user_agent(?P<user_agent>[^"]+)

" "the literal text " "

Group ssl_cipher(?P<ssl_cipher>[^"]+)

" the literal text "

Group ssl_protocol(?P<ssl_protocol>[- A-Z0-9a-z.]+)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

(?P<timestamp>[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9A-Z]+) (?P<elbName>[a-zA-Z-]+) (?P<clientPort>[0-9.:]+) (?P<backendPort>[0-9.:]+) (?P<request_processing_time>[.0-9-]+) (?P<response_processing_time>[.0-9]+) (?P<elb_status_code>[.0-9-]+) (?P<backend_status_code>[0-9-]+) (?P<received_bytes>[0-9-]+) (?P<sent_bytes>[0-9-]+) (?P<request>[0-9-]+) "(?P<user_agent>[^"]+)" "(?P<ssl_cipher>[^"]+)" (?P<ssl_protocol>[- A-Z0-9a-z.]+)

New

---ELB LOGS--- 


2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000073 0.001048 0.000057 200 200 0 29 "GET http://www.example.com:80/ HTTP/1.1" "curl/7.38.0" - -

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000086 0.001048 0.001337 200 200 0 57 "GET https://www.example.com:443/ HTTP/1.1" "curl/7.38.0" DHE-RSA-AES128-SHA TLSv1.2

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.001069 0.000028 0.000041 - - 82 305 "- - - " "-" - -

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.001065 0.000015 0.000023 - - 57 502 "- - - " "-" ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2


 elb client:port backend:port request_processing_time backend_processing_time response_processing_time elb_status_code backend_status_code received_bytes sent_bytes "request" "user_agent" ssl_cipher ssl_protocol

Substitution

---ELB LOGS--- 


2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000073 0.001048 0.000057 200 200 0 29 "GET http://www.example.com:80/ HTTP/1.1" "curl/7.38.0" - -

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.000086 0.001048 0.001337 200 200 0 57 "GET https://www.example.com:443/ HTTP/1.1" "curl/7.38.0" DHE-RSA-AES128-SHA TLSv1.2

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.001069 0.000028 0.000041 - - 82 305 "- - - " "-" - -

2015-05-13T23:39:43.945958Z my-loadbalancer 192.168.131.39:2817 10.0.0.1:80 0.001065 0.000015 0.000023 - - 57 502 "- - - " "-" ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2


 elb client:port backend:port request_processing_time backend_processing_time response_processing_time elb_status_code backend_status_code received_bytes sent_bytes "request" "user_agent" ssl_cipher ssl_protocol