regex101: PCRE (Legacy) Match Workspace

Pro

User-Agentthe literal text User-Agent (case sensitive)

Group ip(?<ip>[^()]*$(?<device>[^()]*)$.*X-Forwarded-Proto)

Negated Character Class[^()]*

*matches any number of characters outside the set below:

(the literal ( (40₁₀ / 50₈ / 28₁₆)

)the literal ) (41₁₀ / 51₈ / 29₁₆)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

Group device(?<device>[^()]*)

Negated Character Class[^()]*

*matches any number of characters outside the set below:

(the literal ( (40₁₀ / 50₈ / 28₁₆)

)the literal ) (41₁₀ / 51₈ / 29₁₆)

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

.*any character (except for line terminators), repeated any number of times

X-Forwarded-Protothe literal text X-Forwarded-Proto (case sensitive)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

User-Agent(?<ip>[^()]*\((?<device>[^()]*)\).*X-Forwarded-Proto)

New

User-Agent=Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/15E148 Safari/604.1,X-Forwarded-Proto
User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15,X-Forwarded-Proto

Extraction

User-Agent=Mozilla/5.0 (iPhone; CPU iPhone OS 15_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Mobile/15E148 Safari/604.1,X-Forwarded-Proto
User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15,X-Forwarded-Proto