^start of line
Group date(?P<date>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group time(?P<time>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group time_taken(?P<time_taken>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group c_ip(?P<c_ip>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group cs_username(?P<cs_username>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group cs_auth_group(?P<cs_auth_group>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group x_exception_id(?P<x_exception_id>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group filter_result(?P<filter_result>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
.*?any character (except for line terminators), repeated any number of times
\"the literal " (3410 / 428 / 2216)
Group category(?P<category>[^\"]+) Negated Character Class[^\"]+ +matches at least one character outside the set below:
\"the literal " (3410 / 428 / 2216)
\"the literal " (3410 / 428 / 2216)
\s+any whitespace character, repeated at least once
Group http_referrer(?P<http_referrer>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group sc_status(?P<sc_status>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group action(?P<action>[^\s]+) Negated Character Class[^\s]+ +matches at least one character outside the set below:
\sany whitespace character
\s+any whitespace character, repeated at least once
Group cs_method(?P<cs_method>[^\s]+) Negated Character Class[^\s]+ \s+any whitespace character, repeated at least once
Group http_content_type(?P<http_content_type>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_uri_scheme(?P<cs_uri_scheme>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_host(?P<cs_host>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_uri_port(?P<cs_uri_port>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_uri_path(?P<cs_uri_path>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_uri_query(?P<cs_uri_query>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_uri_extension(?P<cs_uri_extension>[^\s]+) \s+any whitespace character, repeated at least once
\"the literal " (3410 / 428 / 2216)
Group http_user_agent(?P<http_user_agent>[^\"]+) \"the literal " (3410 / 428 / 2216)
\s+any whitespace character, repeated at least once
Group s_ip(?P<s_ip>[^\s]+) \s+any whitespace character, repeated at least once
Group sc_bytes(?P<sc_bytes>[^\s]+) \s+any whitespace character, repeated at least once
Group cs_bytes(?P<cs_bytes>[^\s]+) \s+any whitespace character, repeated at least once
\"?optionally matches the literal " (3410 / 428 / 2216)
Group x_virus_id(?P<x_virus_id>[^\"]+) \"?optionally matches the literal " (3410 / 428 / 2216)
\s+any whitespace character, repeated at least once
\"the literal " (3410 / 428 / 2216)
Group x_bluecoat_application_name(?P<x_bluecoat_application_name>[^\"]+) \"the literal " (3410 / 428 / 2216)
\s+any whitespace character, repeated at least once
\"the literal " (3410 / 428 / 2216)
Group x_bluecoat_application_operation(?P<x_bluecoat_application_operation>[^\"]+) \"the literal " (3410 / 428 / 2216)
g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string