Regex for well-structured logs
Well-structured logs are a style of event formatting that is composed of a set of properties and are presented in the following way:
<name_of_property_1><assignment_character> <value_of_property_1><delimiter_character> <name_of_property_2><assignment_character> <value_of_property_2><delimiter_character> <name_of_property_3><assignment_character> <value_of_property_3><delimiter_character>...
Use the following general guidelines:
- The <assignment_character> either '=' or ':' or a multi-character sequence such as '->'.
- The <delimiter_character> either a white space character (space or tab) or a list delimiter, such as a comma or semi-colon.
- The <value_of_property> and sometimes <name_of_property> are encapsulated in quotation marks or other wrapping characters.
<13>Sep 09 22:40:40 192.0.2.12 action=login accountname=JohnDoe clientIP=192.0.2.24 timestamp=01/09/2016 22:40:39 UTC
The following table shows how the properties of the well-structured log example above, can be captured:
The patterns that are enclosed within the brackets denote the capture group. Each regex in the table captures everything after the equal sign (=) and before the next tab character.