Regular Expressions 101

Pro

for the literal text for (case sensitive)

Group user(?<user>[a-zA-Z\.]+)

Character Class[a-zA-Z\.]+

+matches at least one character from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

.*?any character (except for line terminators), repeated any number of times

Group ip(?<ip>(?:\d{1,3}\.){3}\d{1,3})

Non-Capturing Group(?:\d{1,3}\.){3}

{3}repeats the group contents below exactly 3 times:

\d{1,3}a digit, repeated between 1 and 3 times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d{1,3}a digit, repeated between 1 and 3 times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Detailed match information will be displayed here automatically.

25 tokens

Regular Expression

for (?<user>[a-zA-Z\.]+).*?(?<ip>(?:\d{1,3}\.){3}\d{1,3})

New

Failed password for root from 123.183.209.132 port 39706 ssh2
Failed password for invalid user packer from 13.82.211.217 port 45832 ssh2
reverse mapping checking getaddrinfo for undefined.datagroup.ua [93.183.207.5] failed - POSSIBLE BREAK-IN ATTEMPT!