WARNING: Version 6.0 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« YAML tips and gotchas filebeat.reference.yml »
Elastic Docs ›Filebeat Reference [6.0] ›Configuring Filebeat

Regular expression support

edit

Regular expression support

edit

Filebeat regular expression support is based on RE2.

Filebeat has several configuration options that accept regular expressions. For example, multiline.pattern, include_lines, exclude_lines, and exclude_files all accept regular expressions. Some options, however, such as the prospector paths option, accept only glob-based paths.

Before using a regular expression in the config file, refer to the documentation to verify that the option you are setting accepts a regular expression.

We recommend that you wrap regular expressions in single quotation marks to work around YAML’s string escaping rules. For example, '^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+'.

For more examples of supported regexp patterns, see Managing Multiline Messages. Although the examples pertain to Filebeat, the regexp patterns are applicable to other use cases.

The following patterns are supported:

Pattern Description

Single Characters

x

single character

.

any character

[xyz]

character class

[^xyz]

negated character class

[[:alpha:]]

ASCII character class

[[:^alpha:]]

negated ASCII character class

\d

Perl character class

\D

negated Perl character class

\pN

Unicode character class (one-letter name)

\p{Greek}

Unicode character class

\PN

negated Unicode character class (one-letter name)

\P{Greek}

negated Unicode character class

Composites

xy

x followed by y

x|y

x or y (prefer x)

Repetitions

x*

zero or more x

x+

one or more x

x?

zero or one x

x{n,m}

n or n+1 or …​ or m x, prefer more

x{n,}

n or more x, prefer more

x{n}

exactly n x

x*?

zero or more x, prefer fewer

x+?

one or more x, prefer fewer

x??

zero or one x, prefer zero

x{n,m}?

n or n+1 or …​ or m x, prefer fewer

x{n,}?

n or more x, prefer fewer

x{n}?

exactly n x

Grouping

(re)

numbered capturing group (submatch)

(?P<name>re)

named & numbered capturing group (submatch)

(?:re)

non-capturing group

(?i)abc

set flags within current group, non-capturing

(?i:re)

set flags during re, non-capturing

(?i)PaTTeRN

case-insensitive (default false)

(?m)multiline

multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)

(?s)pattern.

let . match \n (default false)

(?U)x*abc

ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)

Empty Strings

^

at beginning of text or line (m=true)

$

at end of text (like \z not \Z) or line (m=true)

\A

at beginning of text

\b

at ASCII word boundary (\w on one side and \W, \A, or \z on the other)

\B

not at ASCII word boundary

\z

at end of text

Escape Sequences

\a

bell (same as \007)

\f

form feed (same as \014)

\t

horizontal tab (same as \011)

\n

newline (same as \012)

\r

carriage return (same as \015)

\v

vertical tab character (same as \013)

\*

literal *, for any punctuation character *

\123

octal character code (up to three digits)

\x7F

two-digit hex character code

\x{10FFFF}

hex character code

\Q...\E

literal text ... even if ... has punctuation

ASCII Character Classes

[[:alnum:]]

alphanumeric (same as [0-9A-Za-z])

[[:alpha:]]

alphabetic (same as [A-Za-z])

[[:ascii:]]

ASCII (same as \x00-\x7F])

[[:blank:]]

blank (same as [\t ])

[[:cntrl:]]

control (same as [\x00-\x1F\x7F])

[[:digit:]]

digits (same as [0-9])

[[:graph:]]

graphical (same as [!-~] == [A-Za-z0-9!"#$%&'()*+,\-./:;<=>?@[\\\\]^_` {|}~])

[[:lower:]]

lower case (same as [a-z])

[[:print:]]

printable (same as [ -~] == [ [:graph:]])

[[:punct:]]

punctuation (same as [!-/:-@[-`{-~])

[[:space:]]

whitespace (same as [\t\n\v\f\r ])

[[:upper:]]

upper case (same as [A-Z])

[[:word:]]

word characters (same as [0-9A-Za-z_])

[[:xdigit:]]

hex digit (same as [0-9A-Fa-f])

Supported Perl Character Classes

\d

digits (same as [0-9])

\D

not digits (same as [^0-9])

\s

whitespace (same as [\t\n\f\r ])

\S

not whitespace (same as [^\t\n\f\r ])

\w

word characters (same as [0-9A-Za-z_])

\W

not word characters (same as [^0-9A-Za-z_])
« YAML tips and gotchas filebeat.reference.yml »