Common Log Format

Problem

You need a regular expression that matches each line in the log files produced by a web server that uses the Common Log Format.[11] For example:

127.0.0.1 - jg [27/Apr/2012:11:27:36 +0700] "GET /regexcookbook.html HTTP/1.1" 200 2326

The regular expression should have a capturing group for each field, to allow the application using the regular expression to easily process the fields of each entry in the log.

Solution

^(?<client>\S+)\S+(?<userid>\S+)\[(?<datetime>[^\]]+)\]↵
"(?<method>[A-Z]+)(?<request>[^"]+)?HTTP/[0-9.]+"↵
(?<status>[0-9]{3})(?<size>[0-9]+|-)
Regex options: ^ and $ match at line breaks
Regex flavors: .NET, Java 7, XRegExp, PCRE 7, Perl 5.10, Ruby 1.9
^(?P<client>\S+)\S+(?P<userid>\S+)\[(?P<datetime>[^\]]+)\]↵
"(?P<method>[A-Z]+)(?P<request>[^"]+)?HTTP/[0-9.]+"↵
(?P<status>[0-9]{3})(?P<size>[0-9]+|-)
Regex options: ^ and $ match at line breaks
Regex flavors: PCRE 4, Perl 5.10, Python
^(\S+)\S+(\S+)\[([^\]]+)\]"([A-Z]+)([^"]+)?HTTP/[0-9.]+"↵
([0-9]{3})([0-9]+|-)"([^"]*)""([^"]*)"
Regex options: ^ and $ match at line breaks
Regex flavors: .NET, Java, JavaScript, PCRE, Perl, Python, Ruby

Discussion

Creating a regular expressions to match any entry in a log file generally is very straightforward. It certainly is when the log format puts the same information in each entry, just with different values. This is true for web servers that save access logs using the Common Log Format, such as Apache. Each line in the log file is one log ...

Get Regular Expressions Cookbook, 2nd Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.