regex101: PCRE (Legacy) Match Workspace

Pro

Non-Capturing Group(?:id=(?<ID_Firewall>\w+) )

id=the literal text id= (case sensitive)

Group ID_Firewall(?<ID_Firewall>\w+)

\w+any word character, repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

Non-Capturing Group(?:.*time="(?<timestamp>(?:[0-9]{4})-(?:[0-9]{2})-(?:[0-9]{2}) (?:[0-9]{2}):(?:[0-9]{2}):(?:[0-9]{2}))")

.*any character (except for line terminators), repeated any number of times

time="the literal text time=" (case sensitive)

Group timestamp(?<timestamp>(?:[0-9]{4})-(?:[0-9]{2})-(?:[0-9]{2}) (?:[0-9]{2}):(?:[0-9]{2}):(?:[0-9]{2}))

Non-Capturing Group(?:[0-9]{4})

Character Class[0-9]{4}

{4}matches exactly 4 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Non-Capturing Group(?:[0-9]{2})

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

-the literal - (45₁₀ / 55₈ / 2D₁₆)

Non-Capturing Group(?:[0-9]{2})

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

the literal (32₁₀ / 40₈ / 20₁₆)

Non-Capturing Group(?:[0-9]{2})

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Non-Capturing Group(?:[0-9]{2})

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

:the literal : (58₁₀ / 72₈ / 3A₁₆)

Non-Capturing Group(?:[0-9]{2})

Character Class[0-9]{2}

{2}matches exactly 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

"the literal " (34₁₀ / 42₈ / 22₁₆)

Non-Capturing Group(?: fw=(?<IP_Firewall>[[:graph:]]+))

fw=the literal text fw= (case sensitive)

Group IP_Firewall(?<IP_Firewall>[[:graph:]]+)

Character Class[[:graph:]]+

+matches at least one character from the set below:

[:graph:]a printing character, excluding spaces [\x21-\x7E]

Non-Capturing Group(?: pri=(?<Niveau>(?:[0-9]{1,2})))

pri=the literal text pri= (case sensitive)

Group Niveau(?<Niveau>(?:[0-9]{1,2}))

Non-Capturing Group(?:[0-9]{1,2})

Character Class[0-9]{1,2}

{1,2}matches between 1 and 2 characters from the set below:

0-9one character from 0 (48₁₀) to 9 (57₁₀)

Non-Capturing Group(?:.*m=(?<ID_Event>[[:graph:]]+))

.*any character (except for line terminators), repeated any number of times

m=the literal text m= (case sensitive)

Group ID_Event(?<ID_Event>[[:graph:]]+)

Character Class[[:graph:]]+

Non-Capturing Group(?:.*?msg="(?<Description>[^"]+))

Non-Capturing Group(?:.*srcMac=(?<MAC_Source>[[:graph:]]+))?

Non-Capturing Group(?:.*src=(?<IP_Source>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)

Non-Capturing Group(?::(?<Port_Source>[[:digit:]]+)?)

Non-Capturing Group(?::(?<INT_Source>[[:graph:]]+))

Non-Capturing Group(?:.*srcZone=(?<Zone_Source>[[:graph:]]+))?

Non-Capturing Group(?:.*natSrc=(?<NAT_Source>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)?

Non-Capturing Group(?::(?<NAT_Port_Source>[[:digit:]]+)?)?

Non-Capturing Group(?:.*dstMac=(?<MAC_Destination>[[:graph:]]+))?

Non-Capturing Group(?:.*dst=(?<IP_Destination>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)

Non-Capturing Group(?::(?<Port_Destination>[[:digit:]]+)?)

Non-Capturing Group(?::(?<INT_Destination>[[:graph:]]+))

Non-Capturing Group(?:.*dstZone=(?<Zone_Destination>[[:graph:]]+))?

Non-Capturing Group(?:.*natDst=(?<NAT_Destination>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)?

Non-Capturing Group(?::(?<NAT_Port_Destination>[[:digit:]]+)?)?

Non-Capturing Group(?:.*usr="(?<Utilisateur>[^"]+))?

Non-Capturing Group(?:.*proto=(?<Protocole>[[:graph:]]+))?

Non-Capturing Group(?:.*rule="(?<Regle>[^"]+))?

Non-Capturing Group(?:.*appName="(?<Nom_Application>[^"]+))?

Non-Capturing Group(?:.*dstname=(?<Nom_Destination>[[:graph:]]+))?

Non-Capturing Group(?:.*arg=(?<Argument_DST>[[:graph:]]+))?

Non-Capturing Group(?:.*Category="(?<Categorie>[^"]+))?

Non-Capturing Group(?:.*note="(?<Note>[^"]+))?

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

(?:id=(?<ID_Firewall>\w+) )(?:.*time="(?<timestamp>(?:[0-9]{4})-(?:[0-9]{2})-(?:[0-9]{2}) (?:[0-9]{2}):(?:[0-9]{2}):(?:[0-9]{2}))")(?: fw=(?<IP_Firewall>[[:graph:]]+))(?: pri=(?<Niveau>(?:[0-9]{1,2})))(?:.*m=(?<ID_Event>[[:graph:]]+))(?:.*?msg="(?<Description>[^"]+))(?:.*srcMac=(?<MAC_Source>[[:graph:]]+))?(?:.*src=(?<IP_Source>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)(?::(?<Port_Source>[[:digit:]]+)?)(?::(?<INT_Source>[[:graph:]]+))(?:.*srcZone=(?<Zone_Source>[[:graph:]]+))?(?:.*natSrc=(?<NAT_Source>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)?(?::(?<NAT_Port_Source>[[:digit:]]+)?)?(?:.*dstMac=(?<MAC_Destination>[[:graph:]]+))?(?:.*dst=(?<IP_Destination>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)(?::(?<Port_Destination>[[:digit:]]+)?)(?::(?<INT_Destination>[[:graph:]]+))(?:.*dstZone=(?<Zone_Destination>[[:graph:]]+))?(?:.*natDst=(?<NAT_Destination>(?:[[:digit:]]+\.){3}(?:[[:digit:]]+))?)?(?::(?<NAT_Port_Destination>[[:digit:]]+)?)?(?:.*usr="(?<Utilisateur>[^"]+))?(?:.*proto=(?<Protocole>[[:graph:]]+))?(?:.*rule="(?<Regle>[^"]+))?(?:.*appName="(?<Nom_Application>[^"]+))?(?:.*dstname=(?<Nom_Destination>[[:graph:]]+))?(?:.*arg=(?<Argument_DST>[[:graph:]]+))?(?:.*Category="(?<Categorie>[^"]+))?(?:.*note="(?<Note>[^"]+))?

New

<134> id=FIREWALL_SYSLOG time="2019-03-21 12:30:24" fw=1.1.1.1 pri=6 c=1024 gcat=6 m=537 msg="Connection Closed" srcMac=aa:bb:cc:dd:ee:ff src=2.2.2.2:12345:X1 srcZone=LAN natSrc=3.3.3.3:54321 dstMac=gg:hh:ii:jj:kk:ll dst=4.4.4.4:443:X2 dstZone=WAN natDst=5.5.5.5:443 usr="Unknown" proto=tcp/https sent=1348 rcvd=8230 spkt=10 rpkt=9 cdur=2266 rule="(WAN->WAN)" app=49177 appName="HTTPS" n=55917537