# RegEx works on regex101.com but not

**URL:** <https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272>\
**Category:** Graylog Central (peer support)\
**Created:** [December 22, 2019, 10:16pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272 "2019-12-22T22:16:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![MyCodeRocks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mycoderocks/32/5530_2.png) [@MyCodeRocks](https://community.graylog.org/u/MyCodeRocks)\
**Post date:** [December 22, 2019, 10:16pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/1 "2019-12-22T22:16:03Z")

</div>

I know I am doing something simple here but just can’t find it.  
With the following message: {{Replaced IPs with x’s}}

`snort[42549]: [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before client request [Classification: Unknown Traffic] [Priority: 3] {TCP} x.x.x.x:8088 -> x.x.x.x:3609`4

I can get pretty good matches with:  
`\[Classification: (.+?)\] \[Priority: (\d+)\] \{(.+?)\} (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))? -> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))?\R?`

on [www.regex101.com](http://www.regex101.com)

When i replace:  
rule “Extract Snort alert fields”  
when  
has\_field(“message”)  
then  
let m = regex("\[(\d+):(\d+):(\d+)\] (.+?) \[Classification: (.+?)\] \[Priority: (\d+)]: \\<(.+?)\\> \{(.+?)\} (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))? -\> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))?\R?", to\_string($message.message));

the regex portion with:  
` \[Classification: (.+?)\] \[Priority: (\d+)\] \{(.+?)\} (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))? -> (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(:(\d{1,5}))?\R?`

I get an error on that line: _Invalid Expression line 5 (which is the regex) column 36 (which I am not sure how to read that)_

Now this is probably due to regex formatting i.e. Java requires \ instead of \ how ever replaced all the \ with \ and still get same error.

Any ideas?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [December 23, 2019, 5:46pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/2 "2019-12-23T17:46:57Z")

</div>

you need double escape. eg. \d

---

<div class="post-metadata">

**Author:** ![MyCodeRocks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mycoderocks/32/5530_2.png) [@MyCodeRocks](https://community.graylog.org/u/MyCodeRocks)\
**Post date:** [December 23, 2019, 7:57pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/3 "2019-12-23T19:57:58Z")

</div>

Thank you very much for the response. Do I need to escape everything with a \ or just the \d and is the escape \ or / all these different languages for a newbie like me is confusing me ☹

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [December 23, 2019, 9:10pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/4 "2019-12-23T21:10:08Z")

</div>

\\ instead \  
And I suggest start with little things first …

---

<div class="post-metadata">

**Author:** ![MyCodeRocks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mycoderocks/32/5530_2.png) [@MyCodeRocks](https://community.graylog.org/u/MyCodeRocks)\
**Post date:** [December 23, 2019, 9:34pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/5 "2019-12-23T21:34:28Z")

</div>

Thank you once again I have tried

`let m = regex("\[Classification: (.+?)\] \[Priority: (\\d+)\] \{(.+?)\} (\\d{1,3}\.\\d{1,3}\.\\d{1,3}\.\\d{1,3})(:(\\d{1,5}))? -> (\\d{1,3}\.\\d{1,3}\.\\d{1,3}\.\\d{1,3})(:(\\d{1,5}))?\R?", to_string($message.message));`

Still no luck do I need to escape all \ or just \d. Still invalid expression at column 36

---

<div class="post-metadata">

**Author:** ![MyCodeRocks](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mycoderocks/32/5530_2.png) [@MyCodeRocks](https://community.graylog.org/u/MyCodeRocks)\
**Post date:** [December 23, 2019, 9:47pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/6 "2019-12-23T21:47:59Z")

</div>

Seems like all \ need to be escaped this worked:

`\\[Classification: (.+?)\\] \\[Priority: (\\d+)\\] \\{(.+?)\\} (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))? -> (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))?\\R?`

Thank you for the guidance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 6, 2020, 9:48pm UTC](https://community.graylog.org/t/regex-works-on-regex101-com-but-not/13272/7 "2020-01-06T21:48:00Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.