regex101: Journalctl

^start of line

Group DateTime(?'DateTime'(?'Month'[A-Za-z]+)\s+(?'Day'0?[1-9]|[12][0-9]|3[01])\s+(?'Time'[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,3})?))

Group Month(?'Month'[A-Za-z]+)

Character Class[A-Za-z]+

+matches at least one character from the set below:

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

\s+any whitespace character, repeated at least once

Group Day(?'Day'0?[1-9]|[12][0-9]|3[01])

1st Alternative0?[1-9]

0?optionally matches the literal 0 (48₁₀ / 60₈ / 30₁₆)

Character Class[1-9]

1-9one character from 1 (49₁₀) to 9 (57₁₀)

2nd Alternative[12][0-9]

Character Class[12]

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-9]

0-9one character from 0 (48₁₀) to 9 (57₁₀)

3rd Alternative3[01]

3the literal 3 (51₁₀ / 63₈ / 33₁₆)

Character Class[01]

0the literal 0 (48₁₀ / 60₈ / 30₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

\s+any whitespace character, repeated at least once

Group Time(?'Time'[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,3})?)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Group 5(\.[0-9]{1,3})?

?repeats the group contents below at most once:

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

Character Class[0-9]{1,3}

{1,3}matches between 1 and 3 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

\Wany non-word character

Group Full_Host(?'Full_Host'[alnum]|(?:(?'Host_prefix'(?:[A-Za-z])-?)(?'Host'[A-Za-z]+)-*(?'Host_suffix'-{1}[A-Za-z]+)))

1st Alternative[alnum]

Character Class[alnum]

athe literal a (97₁₀ / 141₈ / 61₁₆) (case sensitive)

lthe literal l (108₁₀ / 154₈ / 6C₁₆) (case sensitive)

nthe literal n (110₁₀ / 156₈ / 6E₁₆) (case sensitive)

uthe literal u (117₁₀ / 165₈ / 75₁₆) (case sensitive)

mthe literal m (109₁₀ / 155₈ / 6D₁₆) (case sensitive)

2nd Alternative(?:(?'Host_prefix'(?:[A-Za-z])-?)(?'Host'[A-Za-z]+)-*(?'Host_suffix'-{1}[A-Za-z]+))

Non-Capturing Group(?:(?'Host_prefix'(?:[A-Za-z])-?)(?'Host'[A-Za-z]+)-*(?'Host_suffix'-{1}[A-Za-z]+))

Group Host_prefix(?'Host_prefix'(?:[A-Za-z])-?)

Non-Capturing Group(?:[A-Za-z])

Character Class[A-Za-z]

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

-?optionally matches the literal - (45₁₀ / 55₈ / 2D₁₆)

Group Host(?'Host'[A-Za-z]+)

-*the literal - (45₁₀ / 55₈ / 2D₁₆) , repeated any number of times

Group Host_suffix(?'Host_suffix'-{1}[A-Za-z]+)

\Wany non-word character

Group Msg_Sender(?'Msg_Sender'(?:\s?\S+:\s)+)?

Group Log_Msg(?'Log_Msg'[[:blank:][:alnum:][:punct:]]+)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

^(?'DateTime'(?'Month'[A-Za-z]+)\s+(?'Day'0?[1-9]|[12][0-9]|3[01])\s+(?'Time'[0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,3})?))\W(?'Full_Host'[alnum]|(?:(?'Host_prefix'(?:[A-Za-z])-?)(?'Host'[A-Za-z]+)-*(?'Host_suffix'-{1}[A-Za-z]+)))\W(?'Msg_Sender'(?:\s?\S+:\s)+)?(?'Log_Msg'[[:blank:][:alnum:][:punct:]]+)

Test String
New

May 18 11:02:26 example-host-name kernel: Linux version 6.9.0-gentoo-x86_64 (root@example-host-builder) (x86_64-pc-linux-gnu-gcc (Gentoo Hardened 13.2.1_p20240210 p14) 13.2.1 20240210, GNU ld (Gentoo 2.42 p3) 2.42.0) #1 SMP PREEMPT_DYNAMIC Fri May 17 01:42:56 PDT 2024
May 18 11:02:26 example-host-name kernel: Kernel is locked down from Kernel configuration; see man kernel_lockdown.7
May 18 11:02:26 example-host-name kernel: Command line: BOOT_IMAGE=(lvm/vg0-gentoo--root--two)/boot/vmlinuz-6.9.0-gentoo-x86_64.signed root=/dev/dm-4
May 18 11:02:26 example-host-name kernel: x86/split lock detection: #AC: crashing the kernel on kernel split_locks and warning on user-space split_locks
May 18 11:02:26 example-host-name kernel: BIOS-provided physical RAM map:
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009dfff] usable
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x000000000009e000-0x000000000009efff] reserved
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x000000000009f000-0x000000000009ffff] usable
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x00000000000a0000-0x00000000000fffff] reserved
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x0000000000100000-0x000000003aae7fff] usable
May 18 11:02:26 example-host-name kernel: BIOS-e820: [mem 0x000000003aae8000-0x000000004395efff] reserved

Regular Expression

Test StringNew

Test String
New