regex101: PCRE2 (PHP) Match Workspace

Group 2(EventCode(?:\S+)5156)

EventCodethe literal text EventCode (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

5156the literal text 5156

Character Class[\s\S]*

*matches any number of characters from the set below:

\sany whitespace character

\Sany non-whitespace character

1st Alternative((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))

Group 4((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))

Group 5(((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.)

Group 6((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:Source Address|Destination Address)

1st AlternativeSource Address

Source Addressthe literal text Source Address (case sensitive)

2nd AlternativeDestination Address

Destination Addressthe literal text Destination Address (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

Non-Capturing Group(?:\s)+

+repeats the group contents below at least once:

\sany whitespace character

10the literal text 10

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

2nd Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])

Group 7(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])

Group 8((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:Source Address|Destination Address)

1st AlternativeSource Address

Source Addressthe literal text Source Address (case sensitive)

2nd AlternativeDestination Address

Destination Addressthe literal text Destination Address (case sensitive)

Non-Capturing Group(?:\S+)

\S+any non-whitespace character, repeated at least once

Non-Capturing Group(?:\s)+

+repeats the group contents below at least once:

\sany whitespace character

172the literal text 172

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

1the literal 1 (49₁₀ / 61₈ / 31₁₆)

Character Class[6-9]

6-9one character from 6 (54₁₀) to 9 (57₁₀)

3rd Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])

Group 9(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])

Group 10((?:Source Address|Destination Address)(?:\S+))

Non-Capturing Group(?:\s)+

172the literal text 172

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

2the literal 2 (50₁₀ / 62₈ / 32₁₆)

Character Class[0-9]

4th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])

5th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)

6th Alternative(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168)

Character Class[\s\S]*

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

((EventCode(?:\S+)5156)[\s\S]*(((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.))|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168))[\s\S]*((((?:Source Address|Destination Address)(?:\S+))(?:\s)+10\.)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.1[6-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.2[0-9])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+172\.3[0-1])|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+127\.0\.0\.1)|(((?:Source Address|Destination Address)(?:\S+))(?:\s)+192\.168)))

Unit Tests

There are no unit tests, click to add some.