Regular expressions are powerful tools for text matching that allow you to find specific patterns in text. This topic provides a simple, practical tutorial to help you quickly learn the basics.
This topic may contain information about third-party products. The information is for reference only. Alibaba Cloud does not make any promises or guarantees about the performance, reliability, or potential impacts of any operations that are performed on third-party products.
If you are not familiar with regular expressions, you can use a tool such as Regex101 to practice and test them. These tools visualize the matching process between a regular expression and text. This topic uses Regex101 to illustrate the examples.
Basic syntax
A regular expression consists of different types of characters, including literal characters, metacharacters, delimiters, and escape characters.
Literal character: Matches a character as it is.
Metacharacter: Matches a specific character or character set. For example,
.matches any character, and\dmatches any digit.Delimiter: Marks the start and end of a regular expression. A forward slash (
/) or a number sign (#) is typically used.Escape character: Treats a special character, such as a metacharacter or delimiter, as a literal character. A backslash (
\) is used as an escape character. For example,\.matches a period.
As shown in the following figure, the Regex101 tool adds the delimiter / before and after the regular expression a.\d\. by default. In this expression, a matches the letter a, . matches any single character, \d matches any single digit, and \. matches a period.
The following table describes commonly used special characters and their meanings.
The supported symbols and syntax may vary across programming languages and regular expression engines. When you write code, refer to the documentation for your specific language or tool to confirm the supported regular expression syntax.
Symbol | Meaning |
| Matches any single character except a line feed. |
| Matches any digit character. Equivalent to [0-9]. |
| Matches any non-digit character. Equivalent to [^0-9]. |
| Matches any letter, digit, or underscore character. Equivalent to [A-Za-z0-9_]. |
| Matches any character except letters, digits, and underscore characters. Equivalent to [^A-Za-z0-9_]. |
| Matches any whitespace character, including spaces, tab characters, and line feeds. |
| Matches any non-whitespace character. |
| Matches a word boundary, which is the position between a word character and a non-word character. |
| Matches a non-word boundary. |
| Matches the preceding element zero or more times. |
| Matches the preceding element one or more times. |
| Matches the preceding element zero or one time. |
| Acts as an OR operator between two alternatives. |
| Matches the preceding element exactly n times. |
| Matches the preceding element at least n times. |
| Matches the preceding element at least n times but no more than m times. |
| Matches any single character in the character set. |
| Matches any single character not in the character set. |
| Matches the start of a string. |
| Matches the end of a string. |
| Groups a set of characters to be treated as a single unit. |
| A common delimiter used to mark the start and end of a regular expression. |
| Escape character. Use the backslash ( |
Examples
Example 1: Match a string that contains a specific keyword
Match logs that contain the keyword 05/Jan/2023.
Sample logs: Info 05/Jan/2023 Warning, Info 06/Jan/2023 Error
Regular expression:
.*05\/Jan\/2023.*.*matches zero or more of any character. This means any characters can appear before or after05/Jan/2023.05\/Jan\/2023matches the keyword05/Jan/2023.Logtail uses the forward slash (
/) as a delimiter. Therefore, you must use a backslash (\) as an escape character to match a literal forward slash.
Example 2: Match a mobile phone number
Match logs that contain an 11-digit mobile phone number that starts with 111 or 222.
Sample numbers: 11144445555, 22266667777, 33388889999
Regular expression:
(111|222)\d{8}A mobile phone number consists of a three-digit carrier code, a four-digit area code, and a four-digit subscriber number. Assume the carrier code is either 111 or 222, and the other digits can be any number.
(111|222)represents a group that contains two possible values: 111 or 222.\dmatches a single digit.{8}specifies that the preceding element,\d, must be matched exactly eight times. This matches eight digits.
Example 3: Match a complete string
Match logs that are in the [Time] [Level] [Module] [Information] format. The time must be in the yyyy-mm-dd hh:mm:ss format. The level can be DEBUG, INFO, WARN, or ERROR. The module and information can be any string.
Sample log: [2021-09-23 10:23:45] [INFO] [user login] [user login success]
Regular expression:
^\[\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\] \[(DEBUG|INFO|WARN|ERROR)\] \[.+\] \[.+\]$\[and\]match the literal characters[and]. Because brackets have a special meaning in regular expression syntax, they must be escaped with a backslash (\).\[\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\]matches the date and time.\[(DEBUG|INFO|WARN|ERROR)\]matches the log level.\[.+\] \[.+\]$matches non-empty strings.
Example 4: Match a string that does not start with a specific keyword
Match logs that do not start with DEBUG.
Sample logs: DEBUG: test debug, INFO: test info
Regular expression:
^(?!DEBUG).*^matches the start of the string. This ensures the pattern checks from the beginning of the line.(?!DEBUG)is a negative lookahead. It asserts that the string does not start with DEBUG. The format is(?!<pattern>), where<pattern>is the content to exclude..*matches the rest of the line.
Example 5: Match a string that does not contain a specific keyword
Match logs that do not contain INFO or DEBUG.
Sample logs: hello world, INFO, ERROR message, DEBUG, warning log, error INFO, debug detail, info status
Regular expression:
^(?!.*(INFO|DEBUG)).*^anchors the pattern to the start of the string.(?!.*(INFO|DEBUG))is a negative lookahead. It asserts that the string does not contain `INFO` or `DEBUG` anywhere..*matches all characters to the end of the log line.
