iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Log Lines

By · Reviewed & last updated · Part of RegEx Tutorial

Log parsing is where regex pays its rent. Most production log formats are line-oriented and reasonably regular: a timestamp, a level, a source, and a message. Named groups make the regex self-documenting, and an anchored pattern (^ and $) prevents partial matches from silently extracting nonsense.

Parse common log formats with named groups

EXAMPLE
import re
from datetime import datetime

# 1) Nginx combined log format
NGINX = re.compile(
    r'^(?P<ip>\d+\.\d+\.\d+\.\d+) '
    r'\S+ \S+ '
    r'\[(?P<ts>[^\]]+)\] '
    r'"(?P<method>[A-Z]+) (?P<path>[^ ]+) HTTP/[\d.]+" '
    r'(?P<status>\d{3}) (?P<bytes>\d+|-) '
    r'"(?P<referer>[^"]*)" "(?P<ua>[^"]*)"$'
)

line = '203.0.113.5 - - [11/Jun/2026:10:32:14 +1000] "GET /api/users HTTP/1.1" 200 1532 "-" "curl/8.6"'
m = NGINX.match(line)
if m:
    d = m.groupdict()
    d['ts'] = datetime.strptime(d['ts'], '%d/%b/%Y:%H:%M:%S %z')
    d['status'] = int(d['status'])
    print(d)

# 2) Laravel log lines
LARAVEL = re.compile(
    r'^\[(?P<ts>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})\] '
    r'(?P<env>\w+)\.(?P<level>\w+): '
    r'(?P<message>.*)$'
)
print(LARAVEL.match('[2026-06-11 10:30:00] production.ERROR: Order #1234 declined').groupdict())

# 3) Multi-line stack trace — combine lines first, then extract
STACK_START = re.compile(r'^\[(\d{4}-\d{2}-\d{2}[^\]]+)\]')
events = []
current = []
for raw in [
    '[2026-06-11 10:30:00] production.ERROR: boom',
    '#0 /app/Foo.php(42): bar()',
    '#1 {main}',
    '[2026-06-11 10:30:01] production.INFO: next event',
]:
    if STACK_START.match(raw) and current:
        events.append('\n'.join(current)); current = []
    current.append(raw)
if current: events.append('\n'.join(current))
print(f'parsed {len(events)} events')

Why it matters

Compile patterns once (module level) when you parse many lines — re.compile is cheap but the lookup per call still adds up. For very large files prefer re.finditer over splitting and matching individually; it avoids materialising the line list.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
// Apache common log line
const re = /^(?<ip>\S+) \S+ \S+ \[(?<ts>[^\]]+)] "(?<method>\S+) (?<path>\S+) (?<proto>HTTP\/[\d.]+)" (?<status>\d{3}) (?<size>\d+|-)/;
Try it Yourself »

Discussion

Loading…