Documentation forKiwi Syslog Server

Regular expressions supported by KSS NG

When adding a Kiwi Syslog Server NG filter based on IP address, host name, or message text, use the following regular expression characters and sequences to specify the filter values.

Character Description
^

Looks only at specified characters at the beginning of a string.

Example: ^stuff matches any string starting with stuff.
$

Looks only at specified characters at the end of a string.

Example: stuff$ matches any string ending with stuff.
.

Matches any character, except line breaks.

Example: o.d matches old, odd, or ord.
?

Matches when the previous character is repeated zero or one time.

Example: od? matches o or od.
*

Matches when the previous character is repeated zero or more times.

Example: 10* matches 1, 10, 100, 1000, and so on.
+

Matches when the previous character is repeated one or more times.

Example: 12+3 matches 123, 12223, 1222223, and so on. Does not match 13.
\

Escapes the next character.

When the next character in the syntax is a special character, use this to indicate that the character should be interpreted literally.

Example: \.\*\+\\ matches .*+\.

|

Separates alternative word or letters.

Example: z|wood matches both z and wood. And (Hello | Hi) world matches Hello world and Hi world.

{n}

Matches the preceding character exactly n times, where n is a non-negative integer.

Example: o{2} does not match the singular o in Bob, but matches the first two o's in foooood.
{n,}

Matches the preceding character at least n times.

Example: o{2} does not match the singular o in Bob, but matches all the repeating o's in foooood. o{1,} is equivalent to o+. o {0,} is equivalent to o*.
{n,m}

Matches the preceding character at least n times but not more than m times.

Example: o{1,3} matches the first three o's in fooooood. o{0,1} is equivalent to o?.
[]

Matches any character enclosed within the brackets.

Example: [abc] matches the a in plain.
[^ ]

Matches any character not enclosed within the brackets.

Example: [^abc] matches the k in back.
[a-z]

Matches any character in the specified range.

Example: [m-s] matches any lowercase alphabetic character in the range m through s.
[^a-z]

Matches any character not in the specified range.

Example: [^m-s] matches any character not in the range m through s.
\b

Matches a word boundary, that is, the position between a word and a space.

Example: er\b matches the er in never but not the er in verb.
\B

Matches a non-word boundary.

Example: ear\B matches the ear in never early.
\0-9 Matches a digit character. Equivalent to [0-9].
\0-9 Matches a non-digit character. Equivalent to [^0-9].
\f Matches a form-feed character.
\n Matches a newline character.
\q

Matches a quote character or ASCII value of 34.

Example: dst=\qLOCAL MACHINE\q matches any occurrence of dst="LOCAL MACHINE"
\r Matches a carriage return character.
\s Matches any white space including space, tab, form-feed, etc. Equivalent to [ \f\n\r\t\v].
\S Matches any nonwhite space character. Equivalent to [^ \f\n\r\t\v].
\t Matches a tab character.
\v Matches a vertical tab character.
\w Matches any word character including underscore. Equivalent to [A-Za-z0-9_].
\W Matches any non-word character. Equivalent to [^A-Za-z0-9_].
(x)\n

Matches consecutive identical characters or strings, where x is the character or string and n is the number of times it is repeated, not including the first occurrence.

Example: (.)\1 matches any two consecutive identical characters.
\n

Matches n, where n is an octal escape value. Octal escape values must be 1, 2, or 3 digits long. For example, \11 and \011 both match a tab character. \0011 is the equivalent of \001 and 1. Octal escape values must not exceed 256. If they do, only the first two digits make up the expression. This allows ASCII codes to be used in regular expressions.
\xn

Matches n, where n is a hexadecimal escape value. Hexadecimal escape values must be exactly two digits long. For example, \x41 matches A. \x041 is equivalent to \x04 and 1. This allows ASCII codes to be used in regular expressions.

Example: dst=\x22LOCAL MACHINE\x22 matches any occurrence of dst="LOCAL MACHINE", because Hex(22) = ASCII 34, or "