Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8
  • .NET 7.0 (C#)
  • Rust
  • Regex Flavor Guide

Function

  • Match
  • Substitution
  • List
  • Unit Tests

Tools

Sponsors
There are currently no sponsors. Become a sponsor today!
An explanation of your regex will be automatically generated as you type.
Detailed match information will be displayed here automatically.
  • All Tokens
  • Common Tokens
  • General Tokens
  • Anchors
  • Meta Sequences
  • Quantifiers
  • Group Constructs
  • Character Classes
  • Flags/Modifiers
  • Substitution
  • A single character of: a, b or c
    [abc]
  • A character except: a, b or c
    [^abc]
  • A character in the range: a-z
    [a-z]
  • A character not in the range: a-z
    [^a-z]
  • A character in the range: a-z or A-Z
    [a-zA-Z]
  • Any single character
    .
  • Alternate - match either a or b
    a|b
  • Any whitespace character
    \s
  • Any non-whitespace character
    \S
  • Any digit
    \d
  • Any non-digit
    \D
  • Any word character
    \w
  • Any non-word character
    \W
  • Non-capturing group
    (?:...)
  • Capturing group
    (...)
  • Zero or one of a
    a?
  • Zero or more of a
    a*
  • One or more of a
    a+
  • Exactly 3 of a
    a{3}
  • 3 or more of a
    a{3,}
  • Between 3 and 6 of a
    a{3,6}
  • Start of string
    ^
  • End of string
    $
  • A word boundary
    \b
  • Non-word boundary
    \B

Regular Expression
No Match

/
/
gm

Test String

Code Generator

Language

Generated Code

# coding=utf8 # the above tag defines encoding for this document and is for Python 2.x compatibility import re regex = r"(.*?<LOC0:DBUG>.*|.*?<USER:DBUG>.*|.*?<SYSD:ERRR>.*?(localhost authd: Logout \(timeout\)|localhost authd.*?Terminal Services compatibility mode.*?).*|.*?<(SAU.|SYSD):INFO>.*|.*?<(SAU2|USER):NOTE>.*)" test_str = ("04 24 2019 10:38:08 10.62.181.191 <LOC0:DBUG> Apr 24 10:38:08 7A5B3SRVSWMGR01 safeguarding[6351]: RadarLite alerts - Start\n" "04 23 2019 13:54:15 10.62.63.21 <USER:DBUG> Apr 23 13:54:15 localhost trafficlogger: cant stat classnames!\n" "04 23 2019 14:05:26 10.62.63.21 <SYSD:ERRR> Apr 23 14:05:26 localhost authd: Logout (timeout); address 10.62.74.83, username CYMRU\\CTT_McKessonSrvAcc, method NTLM authentication (Terminal Services compatibility mode)\n" "04 23 2019 14:05:25 10.62.63.21 <SAU1:INFO> Apr 23 14:05:25 localhost sshd[29491]: Disconnected from 10.62.181.191 port 42412\n" "04 23 2019 14:05:18 10.62.63.21 <SAU1:INFO> Apr 23 14:05:18 localhost sshd[29388]: Received disconnect from 10.62.181.191 port 42358:11: disconnected by user\n" "04 23 2019 14:05:18 10.62.63.21 <SAU1:INFO> Apr 23 14:05:18 localhost sshd[29391]: Accepted publickey for replication from 10.62.181.191 port 42362 ssh2: DSA SHA256:g1/CZCWVxa2uFJpHF1M6vBaNKPk/NjazYr3vTonagbc\n" "04 23 2019 14:05:12 10.62.63.21 <LOC0:DBUG> Apr 23 14:05:12 localhost safeguarding[7272]: Alert user Email/SMS\n" "04 26 2019 10:19:24 10.62.63.21 <USER:NOTE> Apr 26 10:19:24 localhost smoothwall: Completing replication block 01556270336\n" "04 26 2019 10:18:23 10.62.63.21 <USER:NOTE> Apr 26 10:18:23 localhost smoothwall: Duplicating Changes 01556270276\n" "04 26 2019 10:20:57 10.62.181.191 <USER:NOTE> Apr 26 10:20:57 7A5B3SRVSWMGR01 smoothwall: Replication to child 10.62.181.192 changes 01556270457\n" "04 26 2019 10:29:23 10.62.63.21 <USER:NOTE> Apr 26 10:29:23 localhost smoothwall: Starting replication block 01556270936\n" "04 26 2019 11:23:17 10.62.181.191 <SAU2:NOTE> Apr 26 11:23:17 7A5B3SRVSWMGR01 sudo: datastore : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/datastore_update_hardlinks\n\n" "09 05 2019 16:09:15 10.62.181.192 <SYSD:ERRR> Sep 5 16:09:15 localhost authd: Login; address 10.62.182.165, username CYMRU\\ia039398, method NTLM authentication (Terminal Services compatibility mode)\n" "09 05 2019 16:08:20 10.62.181.192 <SYSD:ERRR> Sep 5 16:08:20 localhost authd: Login; address 10.62.182.135, username CYMRU\\Re111052, method NTLM authentication (Terminal Services compatibility mode)\n" "09 05 2019 16:06:34 10.62.181.192 <SYSD:ERRR> Sep 5 16:06:34 localhost authd: Login; address 10.62.180.125, username CYMRU\\Ne036088, method NTLM authentication (Terminal Services compatibility mode)\n" "09 05 2019 09:04:41 10.69.137.81 <SYSD:INFO> 2019:09:05-09:04:40 wf-tg-utm-2 httpproxy[26178]: id=\"0001\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"http access\" action=\"pass\" method=\"GET\" srcip=\"10.69.200.24\" dstip=\"\" user=\"\" group=\"\" ad_domain=\"\" statuscode=\"200\" cached=\"1\" profile=\"REF_HttProContaInterNetwo4 (Clients (DHCP/Static))\" filteraction=\"REF_HttCffWbsBlock (WBS Block)\" size=\"8365\" request=\"0xdaedee00\" url=\"http://download.windowsupdate.com/c/msdownload/update/others/2019/05/28899896_af8426aef8898787eb12d87b445645febda3def8.cab\" referer=\"\" error=\"\" authtime=\"0\" dnstime=\"0\" aptptime=\"65\" cattime=\"0\" avscantime=\"0\" fullreqtime=\"563\" device=\"0\" auth=\"2\" ua=\"Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.0\" exceptions=\"av,auth,content,url,ssl,certcheck,certdate,mime,fileextension,size,patience\"") matches = re.finditer(regex, test_str, re.MULTILINE) for matchNum, match in enumerate(matches, start=1): print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group())) for groupNum in range(0, len(match.groups())): groupNum = groupNum + 1 print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum))) # Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.

Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Python, please visit: https://docs.python.org/3/library/re.html