Regular expression grammar
The Adapter Configuration Editor allows you to use regular expressions to describe how log files should be transformed into Common Base Event records. The following tables are a guideline to regular expression usage.
General rules
- | separates alternatives.
- Expressions within parentheses are matched as subpattern groups and saved for use by certain methods.
- By default, a quantified subpattern matches as many times as possible without causing the rest of the pattern not to match. To change the quantifiers to match the minimum number of times possible, without causing the rest of the pattern not to match, use a ? right after the quantifier.
- Perl5 extended regular expressions are fully supported.
Regular expression matching
| Expression | Matches |
|---|---|
| { n,m} | at least n but not more than m times |
| { n,} | at least n times |
| { n} | exactly n times |
| * | 0 or more times |
| + | 1 or more times |
| ? | 0 or 1 times |
| . | everything except \n in a regular expression within parentheses |
| ^ | a null token matching the beginning of a string or line (i.e., the position right after a newline or right before the beginning of a string) in a regular expression within parentheses |
| $ | a null token matching the end of a string or line (that is, the position right before a newline or right after the end of a string) in a regular expression within parentheses |
| \b | backspace inside a character class ([abcd]) |
| \b | null token matching a word boundary (\w on one side and \W on the other) |
| \B | null token matching a boundary that isn't a word boundary |
| \A | only at beginning of string |
| \Z | only at end of string (or before newline at the end) |
| \ | newline |
| \r | carriage return |
| \t | tab |
| \f | form feed |
| \d | digit [0-9] |
| \D | non-digit [^0-9] |
| \w | word character [0-9a-z_A-Z] |
| \W | non-word character [^0-9a-z_A-Z] |
| \s | a whitespace character [ \t\n\r\f] |
| \S | a non-whitespace character [^ \t\n\r\f] |
| \xnn | the hexadecimal representation of character nn |
| \cD | the corresponding control character |
| \nn or \nnn | the octal representation of character nn unless a backreference. |
| \1, \2, \3... | whatever the first, second, third, and so on, parenthesized group matched. This is called a backreference. If there is no corresponding group, the number is interpreted as an octal representation of a character. |
| \0 | the null character. Any other backslashed character matches itself . |
| *? | 0 or more times |
| +? | 1 or more times |
| ?? | 0 or 1 times |
| { n}? | exactly n times |
| { n,}? | at least n times |
| { n,m}? | at least n but not more than m times |
rouping and extracting matches
To group parts of an expression, use the metacharacters ( ). This allows the regular expression in the parentheses to be treated as a single unit. For example, the regular expression
severity:(1|2)
matches the pattern severity:1 or severity:2.
