CONNthe literal text CONN (case sensitive) \:the literal : (5810 / 728 / 3A16)
.*?any character (except for line terminators), repeated any number of times
prio=the literal text prio= (case sensitive) Group severity(?<severity>\d) \s+any whitespace character, repeated at least once
id=the literal text id= (case sensitive) \d+a digit, repeated at least once
.*?any character (except for line terminators), repeated any number of times
event=the literal text event= (case sensitive) \w+any word character, repeated at least once
\s+any whitespace character, repeated at least once
rule=the literal text rule= (case sensitive) \w+any word character, repeated at least once
\s+any whitespace character, repeated at least once
conn=the literal text conn= (case sensitive) \w+any word character, repeated at least once
\s+any whitespace character, repeated at least once
connipproto=the literal text connipproto= (case sensitive) Group protname(?<protname>\w+) \w+any word character, repeated at least once
\s+any whitespace character, repeated at least once
connrecvif=the literal text connrecvif= (case sensitive) Group dinterface(?<dinterface>\w+) \w+any word character, repeated at least once
\s+any whitespace character, repeated at least once
connsrcip=the literal text connsrcip= (case sensitive) Group sip(?<sip>(\d{1,3}\.){3}\d{1,3}) {3}repeats the group contents below exactly 3 times:
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\s+any whitespace character, repeated at least once
connsrcport=the literal text connsrcport= (case sensitive) \d+a digit, repeated at least once
.*?any character (except for line terminators), repeated any number of times
conndestip=the literal text conndestip= (case sensitive) Group dip(?<dip>(\d{1,3}\.){3}\d{1,3}) {3}repeats the group contents below exactly 3 times:
\d{1,3}a digit, repeated between 1 and 3 times
\.the literal . (4610 / 568 / 2E16)
\d{1,3}a digit, repeated between 1 and 3 times
\s+any whitespace character, repeated at least once
conndestport=the literal text conndestport= (case sensitive) \d+a digit, repeated at least once
g modifier: global. Finds all matches instead of stopping after the first