Can you help me with regex?

[slindstr]

I'm trying to use regex to determine whether or not an entry in a raw log file is valid or not. The line I have been testing my regex on is:

71.64.35.65.cfl.rr.com - - [06/Mar/2001:17:05:43 -0500] "GET /wds/comps/exams/mathsp01.pdf HTTP/1.1" 206 -

The regex I came up with (which doesn't work) is:

\([a-zA-Z0-9]+[.| - - ]\)+\[\d{2}/\D{3}/\d{4}:(\d{2}:){2}\d{2} -\d{4}\] "\D{3,4} .+" \d{3} (\d{4}|-)

See next post - the board won't let me put more code tags 🙁

[slindstr]

Now let's see if I actually understand regex:

\([a-zA-Z0-9]+[.| - - ]\)+

means check for a letter or number repeated one or more times followed by either a period of " - - " and check if all of that is repeated one or more times.

\[\d{2}/\D{3}/\d{4}:(\d{2}:){2}\d{2} -\d{4}\]     

means check for

 [DD/LLL/DDDD:DD:DD:DD -DDD] where D=digit and L = letter

"\D{3,4} .+" \d{3} (\d{4}|-)

means check for 3 or 4 digits followed by a space and then any characters followed by " followed by a space then 3 digits followed by a space followed by either 4 digits or one dash.

Where did I go wrong?

[xblue]

You seem to be misusing the square brackets. Square brackets indicate character classes, so e.g. this [.| - - ] means a period, vertical bar, space or hyphen (and only one of it, repitions would be ignored. For Alternation as you probably intended (either a period or the sequence of " - - ") you would use parentheses instead.

And your escaping looks a little odd to me at first sight, you should not escape paentheses unless you want to match them literally (first sub-pattern you posted).

[masonbarge]

Noob regex user here. I would have thought the first hyphen would be read as a special character.

[xblue]

Yes you are probably right as it is not escaped and within a character class.