regex101: Access Log

Group src_ip(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

\d{1,3}a digit, repeated between 1 and 3 times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d{1,3}a digit, repeated between 1 and 3 times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d{1,3}a digit, repeated between 1 and 3 times

\.the literal . (46₁₀ / 56₈ / 2E₁₆)

\d{1,3}a digit, repeated between 1 and 3 times

\sany whitespace character

\D{1,5}any character that's not a digit, repeated between 1 and 5 times

Group date_time(?<date_time>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group GMT_offset(?<GMT_offset>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group action(?<action>[^ ]+.+a=)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

.+any character (except for line terminators), repeated at least once

a=the literal text a= (case sensitive)

Group hash_url(?<hash_url>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group protocol(?<protocol>[a-zA-Z]+)

Character Class[a-zA-Z]+

+matches at least one character from the set below:

a-zone character from a (97₁₀) to z (122₁₀) (case sensitive)

A-Zone character from A (65₁₀) to Z (90₁₀) (case sensitive)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group code(?<code>\d{1,3})

\d{1,3}a digit, repeated between 1 and 3 times

\sany whitespace character

Group octet(?<octet>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group ratio(?<ratio>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\Wany non-word character

Group percent_comp(?<percent_comp>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\Wany non-word character

Group dst_url(?<dst_url>[^ ]+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

\sany whitespace character

Group user_agent(?<user_agent>[^ ]+.+)

Negated Character Class[^ ]+

+matches at least one character outside the set below:

the literal (32₁₀ / 40₈ / 20₁₆)

.+any character (except for line terminators), repeated at least once

Search reference

Regular Expression

(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s\D{1,5}(?<date_time>[^ ]+)\s(?<GMT_offset>[^ ]+)\s(?<action>[^ ]+.+a=)(?<hash_url>[^ ]+)\s(?<protocol>[a-zA-Z]+)[^ ]+\s(?<code>\d{1,3})\s(?<octet>[^ ]+)\s(?<ratio>[^ ]+)\W(?<percent_comp>[^ ]+)\W(?<dst_url>[^ ]+)\s(?<user_agent>[^ ]+.+)

Test String
New

80.254.146.36 - - [11/Jun/2015:11:04:10 +0000] "GET /alert/process?a=-3-kj8UgHY54dtgX8mZCfPUCRkiu-r_Kh1hnSqbe40rOjxSzUCVGJLfF_PiDhvXVCFsI3a8RMB5tiVZGzG_A0LowA&b=K1ky5h_rXTuqI2kqaBwFai5qnz5xw_pL_RrBcgfqJok-Rrw7d7i2aziQR53ekX-XFPMy2cECsNi1VNW5nIav_sB7MR1WAKQ2pUIc8ypRdROqnwChscBsbvBZb1zLy4e8kP1erE9mOPLoh6afcbOgcPGpeMuauYR8fulX9u5SonSwYN5ms02yd1Z07z9bPZVX9reGuDDJwigALp2gHCl6S8AEWU0sRsZJnadtRbyBOK81pw73OOqtb8JoRPk3415vx279PmJAVt6x3bm47F50yTebSjxAesEDvA9NYCkVWDJCQFppfpHjon2KeoDmdHLmEu9yEzA1dMDIdJCR_4Br8fEw5cqnly2_vUSuSbNvaxfD9OBWmD2X5CoD_6uobS6IW2EzmYJfVGVdOBUqW-QkgYIC2SDVszd1z2CSCix__jQxjllQPXBp0HL864KVErsdUytBL1J0LTJPJQOCBFaTZCGIpyw0EvPqSZ3S5dXi8SolRQm3YK_7SQVI3-4JTNuwzi3G-UeB_M4&blockedUrl=http%3A%2F%2Fad.turn.com%2Fserver%2Fads.js%3Fpub%3D5766351%26cch%3D5766918%26code%3D5766926%26l%3D728x90%26aid%3D35714892%26ahcid%3D11498647%26bimpd%3D%7E4loWx2hBbQDrGFCWDJjke1g42uW7RLTdWiesOx0b3B1KFjiJdGJoNfXmferT63OHUr9sDQYZFDbJH2q768FJZ5h8VG1agJSao30l5WNLKv98yrSWaIELfnH2EFg1BHn3Q8IoGll5sNh0d9FxmcEi9
--eSKj7A7w6cH9Uhu3Nm16AqSNNHfE4_5G_-9t-Ty8MARdvMjrN4H1TX56t3ZdWC9UlEQeIel1lknbmbr9Ki0BWJgEJ-IAqMeVM4yqSn7-2I7cC7e0MtWLbi-AQS39wHwwBttsHbCFeMUOo7uVI70hx392w1cRHX2Hf1Px-Q9fg9k0GTY4hk80E_fsRESHoIpJoCa5Sh7bV9Qa8kly74cRvIvtPhHNjp8xxta0c-ku_8_nm42UVG4C39s HTTP/1.1" 200 2479 -/- (-%) "http://ad.doubleclick.net/N3847/adi/ebay.uk.x.mmp;sz=728x90;ord=1434020649?" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" "1.1 CWS_proxy" "195.212.10.34" 0

Regular Expression

Test StringNew

Test String
New