Regular Expressions 101

Save & Share

Flavor

  • PCRE2 (PHP >=7.3)
  • PCRE (PHP <7.3)
  • ECMAScript (JavaScript)
  • Python
  • Golang
  • Java 8
  • .NET 7.0 (C#)
  • Rust
  • Regex Flavor Guide

Function

  • Match
  • Substitution
  • List
  • Unit Tests

Tools

Sponsors
There are currently no sponsors. Become a sponsor today!
An explanation of your regex will be automatically generated as you type.
Detailed match information will be displayed here automatically.
  • All Tokens
  • Common Tokens
  • General Tokens
  • Anchors
  • Meta Sequences
  • Quantifiers
  • Group Constructs
  • Character Classes
  • Flags/Modifiers
  • Substitution
  • A single character of: a, b or c
    [abc]
  • A character except: a, b or c
    [^abc]
  • A character in the range: a-z
    [a-z]
  • A character not in the range: a-z
    [^a-z]
  • A character in the range: a-z or A-Z
    [a-zA-Z]
  • Any single character
    .
  • Alternate - match either a or b
    a|b
  • Any whitespace character
    \s
  • Any non-whitespace character
    \S
  • Any digit
    \d
  • Any non-digit
    \D
  • Any word character
    \w
  • Any non-word character
    \W
  • Non-capturing group
    (?:...)
  • Capturing group
    (...)
  • Zero or one of a
    a?
  • Zero or more of a
    a*
  • One or more of a
    a+
  • Exactly 3 of a
    a{3}
  • 3 or more of a
    a{3,}
  • Between 3 and 6 of a
    a{3,6}
  • Start of string
    ^
  • End of string
    $
  • A word boundary
    \b
  • Non-word boundary
    \B

Regular Expression
No Match

/
/
g

Test String

Code Generator

Language

Generated Code

# coding=utf8 # the above tag defines encoding for this document and is for Python 2.x compatibility import re regex = r"\s+(?P<tst_dvc>[^\s]+)\s+\w{3}\s+\d{1,2}\s+\d{2}\:\d{2}\:\d{2}\s(?P<tst_cmd>[^:]+):\s+(?P<tst_action>[^\s]+)\s+<\d>(?P<tst_action2>[^\s]+)\s+IN=(?P<tst_in_if>[^\s]+)\s+OUT=(?P<tst_out_if>[^\s]+)\s+<\d>(?P<tst_src_ip>[^\s]+)\s+DST=(?P<tst_dest_ip>[^\s]+)\s+<\d>LEN=(?P<tst_len>[^\s]+)\s+TOS=(?P<tst_tos>[^\s]+)\s+PREC=(?P<tst_prec>[^\s]+)\s+TTL=(?P<tst_ttl>[^\s]+)\s+ID=(?P<tst_id>[^\s]+)\s+(DF\s+|\s+)PROTO=(?P<tst_proto>[^\s]+)\s+<\d>SPT=(?P<tst_src_port>[^\s]+)\s+DPT=(?P<tst_dest_port>[^\s]+)\s+" test_str = ("Sep 10 20:18:17 gateway.3deep.local Sep 10 20:18:17 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=54.208.123.145 DST=192.168.23.50 <1>LEN=60 TOS=0x00 PREC=0x00 TTL=37 ID=28012 DF PROTO=TCP <1>SPT=38859 DPT=443 SEQ=636829265 ACK=0 WINDOW=17922 RES=0x00 SYN URGP=0 OPT (020405AC0402080ABDC6533D0000000001030304) \n" "Sep 9 00:44:27 gateway.3deep.local Sep 9 00:44:27 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=110.167.234.34 DST=192.168.23.50 <1>LEN=48 TOS=0x00 PREC=0x00 TTL=108 ID=3857 DF PROTO=TCP <1>SPT=26932 DPT=443 SEQ=1819196068 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405AC01010402) \n" "Sep 8 22:51:18 gateway.3deep.local Sep 8 22:51:17 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=110.167.234.34 DST=192.168.23.50 <1>LEN=44 TOS=0x00 PREC=0x00 TTL=100 ID=256 PROTO=TCP <1>SPT=12589 DPT=443 SEQ=597164032 ACK=0 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405AC) \n" "Sep 7 02:28:36 gateway.3deep.local Sep 7 02:28:22 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=40 TOS=0x00 PREC=0x00 TTL=247 ID=40368 DF PROTO=TCP <1>SPT=7004 DPT=443 SEQ=1635675828 ACK=2838771327 WINDOW=1024 RES=0x00 ACK URGP=0 \n" "Sep 7 01:36:17 gateway.3deep.local Sep 7 01:36:03 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=52 TOS=0x08 PREC=0x00 TTL=54 ID=1014 DF PROTO=TCP <1>SPT=32594 DPT=443 SEQ=3142748749 ACK=3448075871 WINDOW=863 RES=0x00 ACK RST URGP=0 OPT (0101080A00E4FAF60079E548) \n" "Sep 7 01:36:17 gateway.3deep.local Sep 7 01:36:03 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=83 TOS=0x08 PREC=0x00 TTL=54 ID=1013 DF PROTO=TCP <1>SPT=32594 DPT=443 SEQ=3142748718 ACK=3448075871 WINDOW=863 RES=0x00 ACK PSH URGP=0 OPT (0101080A00E4FAF50079E548) \n" "Sep 7 01:35:38 gateway.3deep.local Sep 7 01:35:24 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=83 TOS=0x08 PREC=0x00 TTL=54 ID=11557 DF PROTO=TCP <1>SPT=5010 DPT=443 SEQ=3044040977 ACK=3364857459 WINDOW=841 RES=0x00 ACK PSH URGP=0 OPT (0101080A00E4ECD6007955EC) \n" "Sep 7 01:35:19 gateway.3deep.local Sep 7 01:35:05 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=52 TOS=0x08 PREC=0x00 TTL=54 ID=23094 DF PROTO=TCP <1>SPT=21273 DPT=443 SEQ=1560229817 ACK=221451921 WINDOW=995 RES=0x00 ACK RST URGP=0 OPT (0101080A00E4E5BE00790C82) \n" "Sep 7 01:35:19 gateway.3deep.local Sep 7 01:35:05 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=83 TOS=0x08 PREC=0x00 TTL=54 ID=23093 DF PROTO=TCP <1>SPT=21273 DPT=443 SEQ=1560229786 ACK=221451921 WINDOW=995 RES=0x00 ACK PSH URGP=0 OPT (0101080A00E4E5BE00790C82) \n" "Sep 7 01:35:17 gateway.3deep.local Sep 7 01:35:03 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=83 TOS=0x08 PREC=0x00 TTL=54 ID=27577 DF PROTO=TCP <1>SPT=7678 DPT=443 SEQ=3690596392 ACK=1344433672 WINDOW=1017 RES=0x00 ACK PSH URGP=0 OPT (0101080A00E4E50000790783) \n" "Sep 7 01:31:00 gateway.3deep.local Sep 7 01:30:45 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=60856 DF PROTO=TCP <1>SPT=7004 DPT=443 SEQ=1635675080 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E486700000000001030307) \n" "Sep 7 01:30:58 gateway.3deep.local Sep 7 01:30:44 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=52 TOS=0x08 PREC=0x00 TTL=54 ID=65096 DF PROTO=TCP <1>SPT=40737 DPT=443 SEQ=3785465976 ACK=3145025690 WINDOW=797 RES=0x00 ACK RST URGP=0 OPT (0101080A00E485C500786FF0) \n" "Sep 7 01:30:58 gateway.3deep.local Sep 7 01:30:44 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=83 TOS=0x08 PREC=0x00 TTL=54 ID=65095 DF PROTO=TCP <1>SPT=40737 DPT=443 SEQ=3785465945 ACK=3145025690 WINDOW=797 RES=0x00 ACK PSH URGP=0 OPT (0101080A00E485C500786FF0) \n" "Sep 7 01:30:55 gateway.3deep.local Sep 7 01:30:41 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=36669 DF PROTO=TCP <1>SPT=17827 DPT=443 SEQ=2974944174 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E484930000000001030307) \n" "Sep 7 01:30:55 gateway.3deep.local Sep 7 01:30:40 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=1001 DF PROTO=TCP <1>SPT=32594 DPT=443 SEQ=3142748053 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E4847C0000000001030307) \n" "Sep 7 01:30:18 gateway.3deep.local Sep 7 01:30:04 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=12619 DF PROTO=TCP <1>SPT=21832 DPT=443 SEQ=1570588497 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E4761A0000000001030307) \n" "Sep 7 01:30:11 gateway.3deep.local Sep 7 01:29:57 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=45093 DF PROTO=TCP <1>SPT=21730 DPT=443 SEQ=2658911151 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E4738A0000000001030307) \n" "Sep 7 01:30:11 gateway.3deep.local Sep 7 01:29:57 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=11542 DF PROTO=TCP <1>SPT=5010 DPT=443 SEQ=3044040312 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E4736E0000000001030307) \n" "Sep 7 01:30:04 gateway.3deep.local Sep 7 01:29:50 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=60 TOS=0x08 PREC=0x00 TTL=54 ID=20511 DF PROTO=TCP <1>SPT=58071 DPT=443 SEQ=2243567858 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405780402080A00E470ED0000000001030307) \n" "Sep 7 01:30:04 gateway.3deep.local Sep 7 01:29:50 kernel: ACCEPT <4>ACCEPT IN=ppp0 OUT=br0 <1>SRC=1.144.97.10 DST=192.168.23.50 <1>LEN=52 TOS=0x08 PREC=0x00 TTL=54 ID=24652 DF PROTO=TCP <1>SPT=13328 DPT=443 SEQ=293238401 ACK=1045411505 WINDOW=12277 RES=0x00 ACK RST URGP=0 OPT (0101080A00E4708E0076D730) ") matches = re.finditer(regex, test_str) for matchNum, match in enumerate(matches, start=1): print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group())) for groupNum in range(0, len(match.groups())): groupNum = groupNum + 1 print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum))) # Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.

Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Python, please visit: https://docs.python.org/3/library/re.html