Logs
Syslog (RFC 5424)
Parses RFC 5424 syslog messages.
Try it in RegexPro →Available in
JavaScript / ECMAScript code
jsJavaScript
const re = new RegExp("^<(\\d{1,3})>(\\d+) (\\S+) (\\S+) (\\S+) (\\S+) (\\S+) (.*)$", "");
const input = "<165>1 2023-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - Application event";
const matches = [...input.matchAll(re)];
console.log(matches.map(m => m[0]));Uses `String.prototype.matchAll` for global iteration (Node 12+ / all modern browsers).
Python (re) code
pyPython
import re
pattern = re.compile(r"^<(\d{1,3})>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (.*)$")
input_text = "<165>1 2023-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - Application event"
for m in pattern.finditer(input_text):
print(m.group(0))Stdlib `re` module — no third-party dependency. Works on Python 3.6+.
Go (RE2) code
goGo
package main
import (
"fmt"
"regexp"
)
func main() {
re := regexp.MustCompile(`^<(\d{1,3})>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (.*)$`)
input := `<165>1 2023-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - Application event`
for _, match := range re.FindAllString(input, -1) {
fmt.Println(match)
}
}Uses `regexp.MustCompile` (panics on bad patterns at startup) and `FindAllString` for all matches.
Pattern
regexengine-agnostic
^<(\d{1,3})>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (.*)$Raw source: ^<(\d{1,3})>(\d+) (\S+) (\S+) (\S+) (\S+) (\S+) (.*)$
How it works
Captures priority, version, timestamp, hostname, app-name, procid, msgid, and message content from standard structured syslog entries.
Examples
Input
<165>1 2023-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - Application eventMatches
<165>1 2023-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 - Application event
Common use cases
- •Log aggregation
- •SIEM tools
- •Cloud observability
Related patterns
Apache Common Log Format
LogsParses Apache Common Log Format entries.
Nginx Error Log
LogsParses Nginx error log lines.
CloudWatch Log Stream Path
LogsMatch AWS CloudWatch log group / stream paths like `/aws/lambda/my-function` or `/aws/ecs/cluster-name`.
Java Stack Trace Line
LogsMatches a single Java stack trace frame line.