WARNING: Version 1.3 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Regular Expression Support
editRegular Expression Support
editFilebeat supports a subset of the regular expression syntax accepted by RE2. Because we use the POSIX implementation, some patterns are currently not supported.
We recommend that you wrap regular expressions in single quotation marks to work around YAML’s string escaping rules. For example, '^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+'
.
For more examples of supported regexp patterns, see Managing Multiline Messages. Although the examples pertain to Filebeat, the regexp patterns are applicable to other use cases.
Supported Patterns
editThe following patterns are supported:
Pattern | Description |
---|---|
|
single character |
|
any character |
|
character class |
|
negated character class |
|
ASCII character class |
|
negated ASCII character class |
|
|
|
|
|
zero or more |
|
one or more |
|
zero or one |
|
|
|
|
|
exactly |
|
zero or more |
|
one or more |
|
zero or one |
|
|
|
|
|
exactly |
|
numbered capturing group (submatch) |
|
at beginning of text or line ( |
|
at end of text (like |
|
bell (same as |
|
form feed (same as |
|
horizontal tab (same as |
|
newline (same as |
|
carriage return (same as |
|
vertical tab character (same as |
|
literal |
|
octal character code (up to three digits) |
|
two-digit hex character code |
|
hex character code |
|
alphanumeric (same as |
|
alphabetic (same as |
|
ASCII (same as |
|
blank (same as |
|
control (same as |
|
digits (same as |
|
graphical (same as |
|
lower case (same as |
|
printable (same as |
|
punctuation (same as |
|
whitespace (same as |
|
upper case (same as |
|
word characters (same as |
|
hex digit (same as |
Unsupported Patterns
editThe following patterns are not supported.
Pattern | Description |
---|---|
Unsupported Single Characters |
|
|
Perl character class |
|
negated Perl character class |
|
Unicode character class (one-letter name) |
|
Unicode character class |
|
negated Unicode character class (one-letter name) |
|
negated Unicode character class |
Unsupported Grouping |
|
|
named & numbered capturing group (submatch) |
|
non-capturing group |
|
set flags within current group, non-capturing |
|
set flags during re, non-capturing |
|
case-insensitive (default false) |
|
multi-line mode: |
|
let |
|
ungreedy: swap meaning of |
Unsupported Empty Strings |
|
|
at beginning of text |
|
at ASCII word boundary ( |
|
not at ASCII word boundary |
|
at end of text |
Unsupported Escape Sequences |
|
|
match a single byte even in UTF-8 mode |
|
literal text |
Unsupported Perl Character Classes |
|
|
digits (same as |
|
not digits (same as |
|
whitespace (same as |
|
not whitespace (same as |
|
word characters (same as |
|
not word characters (same as |