\sany whitespace character
Group filter(?<filter>PFE_FW_SYSLOG_ETH.*:) PFE_FW_SYSLOG_ETHthe literal text PFE_FW_SYSLOG_ETH (case sensitive) .*any character (except for line terminators), repeated any number of times
:the literal : (5810 / 728 / 3A16)
\sany whitespace character
FW:the literal text FW: (case sensitive) \sany whitespace character
Group src_interface(?<src_interface>[^ ]+) Negated Character Class[^ ]+ +matches at least one character outside the set below:
the literal (3210 / 408 / 2016)
\s+any whitespace character, repeated at least once
Group action(?<action>\w+) \w+any word character, repeated at least once
.*any character (except for line terminators), repeated any number of times
Group transport(?<transport>tcp|udp|icmp) tcpthe literal text tcp (case sensitive) udpthe literal text udp (case sensitive) icmpthe literal text icmp (case sensitive) \sany whitespace character
Group src(?<src>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$) 1st Alternative(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) Group 6(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) \d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
2nd Alternative(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$ Non-Capturing Group(?:[0-9a-fA-F]{1,4}:){7} {7}repeats the group contents below exactly 7 times:
Character Class[0-9a-fA-F]{1,4} {1,4}matches between 1 and 4 characters from the set below:
0-9one character from 0 (4810) to 9 (5710)
a-fone character from a (9710) to f (10210) (case sensitive)
A-Fone character from A (6510) to F (7010) (case sensitive)
:the literal : (5810 / 728 / 3A16)
Character Class[0-9a-fA-F]{1,4} {1,4}matches between 1 and 4 characters from the set below:
0-9one character from 0 (4810) to 9 (5710)
a-fone character from a (9710) to f (10210) (case sensitive)
A-Fone character from A (6510) to F (7010) (case sensitive)
$end of line
\sany whitespace character
Group dst(?<dst>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$) 1st Alternative\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} \d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
2nd Alternative(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$ Non-Capturing Group(?:[0-9a-fA-F]{1,4}:){7} {7}repeats the group contents below exactly 7 times:
Character Class[0-9a-fA-F]{1,4} {1,4}matches between 1 and 4 characters from the set below:
0-9one character from 0 (4810) to 9 (5710)
a-fone character from a (9710) to f (10210) (case sensitive)
A-Fone character from A (6510) to F (7010) (case sensitive)
:the literal : (5810 / 728 / 3A16)
Character Class[0-9a-fA-F]{1,4} {1,4}matches between 1 and 4 characters from the set below:
0-9one character from 0 (4810) to 9 (5710)
a-fone character from a (9710) to f (10210) (case sensitive)
A-Fone character from A (6510) to F (7010) (case sensitive)
$end of line
\s+any whitespace character, repeated at least once
Group src_port(?<src_port>[^ ]+) Negated Character Class[^ ]+ +matches at least one character outside the set below:
the literal (3210 / 408 / 2016)
\s+any whitespace character, repeated at least once
Group dest_port(?<dest_port>[^ ]+) Negated Character Class[^ ]+ +matches at least one character outside the set below:
the literal (3210 / 408 / 2016)
\s+any whitespace character, repeated at least once
g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string