regex101: PCRE (Legacy) Match Workspace

Pro

Non-Capturing Group(?:^[A-Z][a-z]+\h+\d{1,2}\h+\d{2}:\d{2}:\d{2}\h+\d{1,3}(?:\.\d{1,3}){3}\b(?=.*?\btype="traffic")(?!.*\btype="utm")|\G(?!^))

1st Alternative^[A-Z][a-z]+\h+\d{1,2}\h+\d{2}:\d{2}:\d{2}\h+\d{1,3}(?:\.\d{1,3}){3}\b(?=.*?\btype="traffic")(?!.*\btype="utm")

^start of line

Character Class[A-Z]

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

Character Class[a-z]+

+matches at least one character from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

\h+any horizontal whitespace character, repeated at least once

\d{1,2}a digit, repeated between 1 and 2 times

\h+any horizontal whitespace character, repeated at least once

\d{2}a digit, repeated exactly 2 times

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\d{2}a digit, repeated exactly 2 times

:the literal : (58₁₀ / 72₈ / 3A₁₆)

\d{2}a digit, repeated exactly 2 times

\h+any horizontal whitespace character, repeated at least once

\d{1,3}a digit, repeated between 1 and 3 times

Non-Capturing Group(?:\.\d{1,3}){3}

{3}repeats the group contents below exactly 3 times:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d{1,3}a digit, repeated between 1 and 3 times

\ban ASCII word boundary

Positive Lookahead(?=.*?\btype="traffic")

.*?any character (except for line terminators), repeated any number of times

\ban ASCII word boundary

type="traffic"the literal text type="traffic" (case sensitive)

Negative Lookahead(?!.*\btype="utm")

.*any character (except for line terminators), repeated any number of times

\ban ASCII word boundary

type="utm"the literal text type="utm" (case sensitive)

2nd Alternative\G(?!^)

\Gstart of current search

Negative Lookahead(?!^)

^start of line

*+repeats the group contents below any number of times:

\h+any horizontal whitespace character, repeated at least once

1st Alternativedev(?:name|id)

devthe literal text dev (case sensitive)

Non-Capturing Group(?:name|id)

1st Alternativename

namethe literal text name (case sensitive)

2nd Alternativeid

idthe literal text id (case sensitive)

2nd Alternativevd

vdthe literal text vd (case sensitive)

3rd Alternativesrc(?:ip|port|intf)

srcthe literal text src (case sensitive)

Non-Capturing Group(?:ip|port|intf)

1st Alternativeip

ipthe literal text ip (case sensitive)

2nd Alternativeport

portthe literal text port (case sensitive)

3rd Alternativeintf

intfthe literal text intf (case sensitive)

4th Alternativedst(?:ip|port|intf)

dstthe literal text dst (case sensitive)

Non-Capturing Group(?:ip|port|intf)

1st Alternativeip

ipthe literal text ip (case sensitive)

2nd Alternativeport

3rd Alternativeintf

5th Alternativeproto

6th Alternativeaction

7th Alternativepolicyid

8th Alternativeuser

9th Alternativeservice

10th Alternativetransport

11th Alternativeapp(?:list)?

12th Alternativevpn(?:type)?

=the literal = (61₁₀ / 75₈ / 3D₁₆)

\h+any horizontal whitespace character, repeated at least once

\S+any non-whitespace character, repeated at least once

\h*any horizontal whitespace character, repeated any number of times

\Kresets the starting point of the reported match. Any previously consumed characters are no longer included in the final match

Negated Character Class[^\s=]+

=the literal = (61₁₀ / 75₈ / 3D₁₆)

\S+any non-whitespace character, repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

(?:^[A-Z][a-z]+\h+\d{1,2}\h+\d{2}:\d{2}:\d{2}\h+\d{1,3}(?:\.\d{1,3}){3}\b(?=.*?\btype="traffic")(?!.*\btype="utm")|\G(?!^))(?:(?!\h+(?:dev(?:name|id)|vd|src(?:ip|port|intf)|dst(?:ip|port|intf)|proto|action|policyid|user|service|transport|app(?:list)?|vpn(?:type)?)=)\h+\S+)*+\h*\K[^\s=]+=\S+

Unit Tests

There are no unit tests, click to add some.