# Regex Creation Tool - Any Ideas?

**URL:** https://community.graylog.org/t/regex-creation-tool-any-ideas/15457
**Category:** Graylog Central (peer support)
**Created:** [May 15, 2020, 11:19am UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457 "2020-05-15T11:19:06Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![bungo63](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@bungo63](https://community.graylog.org/u/bungo63)
#### Post date: [May 15, 2020, 11:19am UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/1 "2020-05-15T11:19:06Z")

</div>

This is probably the wrong category so apologies.  
I am currently using ManageEngine Event Log Analyzer but am looking to move to Graylog.  
MEELA has a cool feature whereby you can parse fields in a sample log by simply highlighting them to create the required regular expression. Its a bit limited but works.  
From what I have seen so far I don’t think Gray log does anything like this (but I’m open to correction).  
I have been looking for similar tool on the internet but cannot find one, so I wondered if any folk out here may know of one.All the tools I’ve seen so far seem to require the user to know regex and provide means to test the coding. I’m looking for something that does the reverse.

---

<div class="post-metadata">

### Author: ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)
#### Post date: [May 18, 2020, 9:52am UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/2 "2020-05-18T09:52:28Z")

</div>

The Graylog has extractors, and pipelines, to do the pharsing.  
And also all feature has a tester, to check it. So I think it is available.  
But graylog won’t write the rexeps instead of you.

---

<div class="post-metadata">

### Author: ![bungo63](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@bungo63](https://community.graylog.org/u/bungo63)
#### Post date: [May 18, 2020, 12:38pm UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/3 "2020-05-18T12:38:13Z")

</div>

Macko003

Thanks for the reply. The manage engine facility is really handy, I’m surprised that I cannot find anything similar out there.

I’ve come across a blog post from Brendan Abolivier which describes the Graylog parsing process so I will give it read and try to apply what it tells me.

---

<div class="post-metadata">

### Author: ![cawfehman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cawfehman/32/4132_2.png) [@cawfehman](https://community.graylog.org/u/cawfehman)
#### Post date: [May 18, 2020, 2:57pm UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/4 "2020-05-18T14:57:52Z")

</div>

Some of the resources I use:

[https://www.rexegg.com](https://www.rexegg.com)  
As far as primer/tutorial go, this is a great site IMO

for regex tools I use both

RegEx Magic and RegEx Buddy

bit of a learning curve, but both are great tools IMO. They are not free, but there is a free trial.

[https://www.regexbuddy.com/](https://www.regexbuddy.com/)  
[https://www.regexmagic.com/](https://www.regexmagic.com/)

---

<div class="post-metadata">

### Author: ![bungo63](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@bungo63](https://community.graylog.org/u/bungo63)
#### Post date: [May 18, 2020, 3:36pm UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/5 "2020-05-18T15:36:43Z")

</div>

Thanks very much – I’ll check them out.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [June 1, 2020, 3:36pm UTC](https://community.graylog.org/t/regex-creation-tool-any-ideas/15457/6 "2020-06-01T15:36:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
