|name |caps|regex=regex=regex=regex=regex |examples |anti-examples |fails|parser |comment
|----------------|----|------------------------------------------|------------------------------------------|-----------------------------------------|-----|-----------------|------------------------------------------
|%address.ipv4 |0 |[0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}[.][0\|0.0.0.0 | | |parseSeverity |an a.b.c.d IPv4 address
| | |\-9]{1,3} |123.45.6.78 |foo | | |
| | | |9.9.9.9 |1234.0.0.0 | | |
| | | |255.255.255.255 |1.2.3 | | |
| | | | |1.2.3. | | |
| | | | |1.2..4 | | |
| | | | |www.example.com | | |
| | | | |2001:0db8:85a3:0000:0000:8a2e:0370:7334 | | |
|%date |0 |[0-9]{4}-[0-9]{2}-[0-9]{2} |2016-12-31 | | |parseDate |a YYYY-MM-DD format date
| | | |0001-01-01 |2016/01/31 | | |
| | | |1000-01-01 |2016-1-31 | | |
| | | | |2016-01-1 | | |
| | | | |2016-001-01 | | |
|%date.slashes |0 |[0-9]{4}/[0-9]{2}/[0-9]{2} |2016/12/31 | | |parseSlashesDate |a YYYY/MM/DD format date
| | | |0001/01/01 |2016-01-31 | | |
| | | |1000/01/01 |2016/1/31 | | |
| | | | |2016/01/1 | | |
| | | | |2016/001/01 | | |
|%datetime |0 |@{%date}[ T]@{%time}(?:@{%timezone}| UTC)\|2016-12-31 23:37:22.525343 UTC | | |parseDateTime |ISO-8601 format date and time + simple va\
| | |\? |2016-12-31 23:37:22.525343 |2016-12-31 23:37:22.525343 EST | | |\riants
| | | |2016-12-31 23:37:22 | | | |
| | | |2016-12-31T23:37:22+0100 | | | |
| | | |2016-12-31T23:37:22-01:00 | | | |
| | | |2016-12-31T23:37:22-23:59 | | | |
| | | |2016-12-31T23:37:22Z | | | |
|%datetime.8601 |0 |@{%date}T@{%time}@{%timezone} |2016-12-31T23:37:22.343Z | | |parseDateTime8601|YYYY-MM-DDTHH:MM:SS[.Q*](Z|[+-]HHMM) form\
| | | |2016-12-31T23:37:22-0100 |2016-12-31 23:37:22.525343 EST | | |\at date and time
| | | |2016-12-31T23:37:22+23:59 | | | |
|%datetime.clf |0 |[0-9]{2}/@{%shortmonth}/[0-9]{4}:[0-9]{2}\|10/Oct/2000:13:55:36 -0700 | | |parseDateTimeCLF |Common Log Format date+time: %d/%b/%Y:%H:\
| | |\:[0-9]{2}:[0-9]{2} [+-][0-9]{2}:?[0-9]{2\|10/Oct/2000:13:55:36 +07:00 |2016-12-31T23:37+0100 | | |\%M:%S %z
| | |\} | |10/Oct/2000:13:55:36-0700 | | |
| | | | |10/OCT/2000:13:55:36 -0700 | | |
| | | | |10/Oct/2000:13:55 -0700 | | |
| | | | |10/Oct/2000:13:55Z | | |
|%email.simple |0 |[a-zA-Z0-9%_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0\|user-name%foo.bar.com@an-example.com | | |- |an email address
| | |\-9.-]+ | |not-an-email-address | | |
| | | | |@not-an-email-address | | |
|%frac |0 |-?[0-9]+(?:\.[0-9]+)? |0 | | |parseInteger |a decimal integer
| | | |1234567890 |0A | | |
| | | |00 |+0 | | |
| | | |01 |0. | | |
| | | |-1 |.0 | | |
| | | |-0 |. | | |
| | | |0.1234567890 |- | | |
| | | |-1.0 |-. | | |
| | | | |-1. | | |
| | | | |-.1 | | |
|%hex |0 |[0-9a-fA-F]+ |0 | | |parseHex |a string of one or more hexadecimal digit\
| | | |12345678 |0x10 | | |\s
| | | |0abcdef |0z | | |
| | | |0ABCDEF |-1a | | |
| | | |00 | | | |
| | | |010 | | | |
|%id |0 |_*[a-zA-Z][a-zA-Z0-9_]* |a | | |- |a standard C-style alphanumeric identifie\
| | | |A |1 | | |\r (with _s)
| | | |A1 |_ | | |
| | | |a_ |__ | | |
| | | |a1_B2 |__1 | | |
| | | |_abc |1a | | |
| | | |__abc |a' | | |
|%id' |0 |_*[a-zA-Z][a-zA-Z0-9_']* |a | | |- |a standard Haskell-style alphanumeric ide\
| | | |A |1 | | |\ntifier (with '_'s and '''s)
| | | |A1 |_ | | |
| | | |a_ |__ | | |
| | | |a1_B2 |__1 | | |
| | | |_abc |1a | | |
| | | |__abc |' | | |
| | | |a' |'a | | |
| | | |_a' |_' | | |
| | | |a'b |_1' | | |
|%id- |0 |_*[a-zA-Z][a-zA-Z0-9_'-]* |a | | |- |an identifier with -s
| | | |A |1 | | |
| | | |A1 |_ | | |
| | | |a_ |__ | | |
| | | |a1_B2 |__1 | | |
| | | |_abc |1a | | |
| | | |__abc |' | | |
| | | |a' |'a | | |
| | | |_a' |_' | | |
| | | |a'b |_1' | | |
| | | |a- | | | |
| | | |a1-B2 | | | |
| | | |a1-B2- | | | |
|%int |0 |-?[0-9]+ |0 | | |parseInteger |a decimal integer
| | | |1234567890 |0A | | |
| | | |00 |+0 | | |
| | | |01 | | | |
| | | |-1 | | | |
| | | |-0 | | | |
|%nat |0 |[0-9]+ |0 | | |parseInteger |a string of one or more decimal digits
| | | |1234567890 |0A | | |
| | | |00 |-1 | | |
| | | |01 | | | |
|%shortmonth |0 |(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oc\|Jan | | |parseShortMonth |three letter month name: Jan-Dec
| | |\t|Nov|Dec) |Feb |jan | | |
| | | |Dec |DEC | | |
| | | | |January | | |
| | | | |01 | | |
| | | | |1 | | |
|%string.simple |0 |"[^"[:cntrl:]]*" |"" | | |parseSimpleString|a decimal integer
| | | |"foo" |" | | |
| | | |"\" |"\"" | | |
| | | |"" |"\"\"" | | |
| | | | |"\"\\\"" | | |
| | | | |"\"foo\"" | | |
| | | | |"aa | | |
|%syslog.severity|0 |(?:emerg|panic|alert|crit|warning|warn|no\|emerg | | |parseSeverity |syslog severity keyword (debug-emerg)
| | |\tice|info|debug|err(?:or)?) |panic |Emergency | | |
| | | |alert |ALERT | | |
| | | |crit | | | |
| | | |err | | | |
| | | |error | | | |
| | | |warn | | | |
| | | |warning | | | |
| | | |notice | | | |
| | | |info | | | |
| | | |debug | | | |
|%time |0 |[0-9]{2}:[0-9]{2}:[0-9]{2}(?:[.][0-9]+)? |00:00:00 | | |parseTimeOfDay |a HH:MM:SS[.Q+]
| | | |23:59:59 |235959 | | |
| | | |00:00:00.1234567890 |10:20 | | |
| | | | |A00:00:00 | | |
| | | | |00:00:00A | | |
| | | | |23:59:59. | | |
|%timezone |0 |(?:Z|[+-][0-9]{2}:?[0-9]{2}) |Z | | |parseTimeZone |an IOS-8601 TZ specification
| | | |+00:00 |00 | | |
| | | |+0000 |A00:00 | | |
| | | |+0200 |UTC | | |
| | | |-0100 |EST | | |
| | | | | EST | | |
|%url |1 |([hH][tT][tT][pP][sS]?|[fF][tT][pP])://[^\|https://mathiasbynens.be/demo/url-regex | | |- |a URL
| | |\[:space:]/$.?#].[^[:space:]]* |http://foo.com/blah_blah |http:// | | |
| | | |http://foo.com/blah_blah/ |http://. | | |
| | | |http://foo.com/blah_blah_(wikipedia) |http://.. | | |
| | | |http://foo.com/blah_blah_(wikipedia)_(aga\|http://../ | | |
| | | |\in) |http://? | | |
| | | |http://www.example.com/wpstyle/?p=364 |http://?? | | |
| | | |HTTPS://foo.bar/?q=Test%20URL-encoded%20s\|http://foo.bar?q=Spaces should be encoded| | |
| | | |\tuff |// | | |
| | | |HTTP://223.255.255.254 |http://##/ | | |
| | | |ftp://223.255.255.254 |http://## | | |
| | | |FTP://223.255.255.254 |http://##/ | | |
|access |9 |(@{%address.ipv4}) - (@{user}) \[(@{%date\|192.168.100.200 - - [12/Jan/2016:12:08:36\| | |parse_a |an Nginx access log file line
| | |\time.clf})\] (@{%string.simple}) (@{%nat\|\ +0000] "GET / HTTP/1.1" 200 3700 "-" "M\| - [] "" "" "" "" | | |
| | |\}) (@{%nat}) (@{%string.simple}) (@{%str\|\y Agent" "-" | | | |
| | |\ing.simple}) (@{%string.simple}) | | | | |
|access_deg |0 | - \[\] "" "" "" "" | - [] "" "" "" "" | | |- |a degenerate Nginx access log file line
| | | | |foo | | |
|error |5 |(@{%date.slashes}) (@{%time}) \[(@{%syslo\|2016/12/21 11:53:35 [emerg] 1378#0: foo | | |parse_e |an Nginx error log file line
| | |\g.severity})\] (@{pid#tid:})(.*) |2017/01/04 05:40:19 [error] 31623#0: *186\|foo | | |
| | | |\1296 no "ssl_certificate" is defined in \| | | |
| | | |\server listening on SSL port while SSL h\| | | |
| | | |\andshaking, client: 192.168.31.38, serve\| | | |
| | | |\r: 0.0.0.0:80 | | | |
|pid#tid: |0 |(?:@{%nat})#(?:@{%nat}): |1378#0: | | |parse_pid_tid |<PID>#<TID>:
| | | | |24#: | | |
| | | | |24.365: | | |
|user |0 |(?:-|[^[:space:]]+) |joe |joe user | |parse_user |a user ident (per RFC1413)