Skip to content

regex.md

Latest commit

 

History

History
212 lines (148 loc) · 5.43 KB

regex.md

File metadata and controls

212 lines (148 loc) · 5.43 KB
Raw

Regex

Regular expressions search for text patterns. They are useful for log analysis, scripting, validation, parsing, and detection engineering, but each tool or language may use a slightly different regex engine.

Regex Tools and Reference

Testers

  • Regex101 - Regex tester and debugger for PCRE, PHP, Python, Go, JavaScript, and more.
  • RegExr - Interactive regex builder and tester.
  • RegEx Testing - Online regex testing tool.
  • RegEx Pal - Online regex testing tool.
  • CyberChef - Includes regex operations alongside encoding, decoding, and data transformation tools.

Training

Cheatsheets and Books

Basics

Common Character Classes

Pattern Meaning
\d Any digit
\D Any non-digit
\w Any word character, usually letters, digits, and underscore
\W Any non-word character
\s Any whitespace character
\S Any non-whitespace character
\t Tab
\r Carriage return
\n Newline

Character Groups

Square brackets define a set or range of characters.

  • [ce] matches c or e.
  • [c-e] matches c, d, or e.
  • [^abc] matches any character except a, b, or c.

Escapes

Regex metacharacters such as ., *, +, ?, (, ), [, ], {, }, |, ^, $, and \ need escaping when you want to match them literally.

\.example\.com

Repetition

Pattern Meaning
* Zero or more of the previous token
+ One or more of the previous token
? Zero or one of the previous token
{m} Exactly m repetitions
{m,n} Between m and n repetitions

By default, quantifiers are greedy. Adding ? makes many quantifiers lazy.

  • .* - Greedy match.
  • .*? - Lazy match.

Anchors

Pattern Meaning
^ Start of line or string
$ End of line or string
\b Word boundary

Example:

^abc\b.*123$

This matches a line that starts with abc as a whole word and ends with 123.

Captures

Parentheses capture part of a matched pattern. Captures are useful for extraction and replacement.

sed -rn 's/.*(capture).*/\1/p' file_name.txt

In grep, -o prints only the matched portion:

grep -Po 'user=\K[^ ]+' auth.log

Lookarounds

Lookarounds are zero-width assertions. They match based on surrounding text without consuming that text.

Pattern Meaning
(?=regex) Positive lookahead
(?!regex) Negative lookahead
(?<=regex) Positive lookbehind
(?<!regex) Negative lookbehind

Example:

(?<![0-2])a

This matches a when it is not preceded by 0, 1, or 2.

Regex in Linux Tools

grep

grep -P "regex" input_file

awk

awk '/regex-pattern/{print $0}' input-file > output-file

sed

sed -rn '/regex-pattern/p' input-file

rg

rg "regex-pattern"
  • ripgrep is a fast line-oriented search tool that recursively searches directories.

Regex in Java

Regex in JavaScript

JavaScript regexes can be created with a literal or the RegExp constructor.

const literal = /my_regex_pattern/gi;
const constructed = new RegExp("my_regex_pattern", "gi");

Common flags:

Flag Meaning
g Global search
i Case-insensitive search
m Multi-line search
s Dot matches newline

Common methods:

Method Action
match() Returns matches from a string
replace() Replaces matching text
search() Returns the index of the first match
test() Returns true or false for whether a match exists
exec() Returns match details from a regex object

Example:

const myIndex = "abracadabra".search(/ra/gi);

Regex in Python

Python's built-in re module supports regular expressions.

import re

my_list = re.split(r"\d", "one: 1 two: 2 three: 3")

Common functions:

Function Action
findall() Returns all matches
search() Returns a match object if the pattern matches anywhere
split() Splits a string at each match
sub() Replaces matches