precursor 0.1.1

A data analysis tool for text and binary tagging and filtering with similarity comparisons.
(?(DEFINE)(?<IP_LOOPBACK>(?:localhost|127(?:\.[0-9]+){0,2}\.[0-9]+$|^(?:0*\:)*?:?0*1)))
(?(DEFINE)(?<USERNAME>(?:[a-zA-Z0-9._-]+)))
(?(DEFINE)(?<USER>(?:(?&USERNAME))))
(?(DEFINE)(?<EMAILLOCALPART>(?:[a-zA-Z][a-zA-Z0-9_.+-=:]+)))
(?(DEFINE)(?<EMAILADDRESS>(?:(?&EMAILLOCALPART)@(?&HOSTNAME))))
(?(DEFINE)(?<INT>(?:[+-]?(?:[0-9]+))))
(?(DEFINE)(?<BASE10NUM>(?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))))
(?(DEFINE)(?<NUMBER>(?:(?&BASE10NUM))))
(?(DEFINE)(?<BASE16NUM>(?:(?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+)))))
(?(DEFINE)(?<BASE16FLOAT>(?:\b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b)))
(?(DEFINE)(?<POSINT>(?:\b(?:[1-9][0-9]*)\b)))
(?(DEFINE)(?<NONNEGINT>(?:\b(?:[0-9]+)\b)))
(?(DEFINE)(?<WORD>(?:\b\w+\b)))
(?(DEFINE)(?<NOTSPACE>(?:\S+)))
(?(DEFINE)(?<SPACE>(?:\s*)))
(?(DEFINE)(?<DATA>(?:.*?)))
(?(DEFINE)(?<GREEDYDATA>(?:.*)))
(?(DEFINE)(?<QUOTEDSTRING>(?:(?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``)))))
(?(DEFINE)(?<UUID>(?:[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12})))
(?(DEFINE)(?<URN>(?:urn:[0-9A-Za-z][0-9A-Za-z-]{0,31}:(?:%[0-9a-fA-F]{2}|[0-9A-Za-z()+,.:=@;$_!*'/?#-])+)))
(?(DEFINE)(?<MAC>(?:(?&CISCOMAC)|(?&WINDOWSMAC)|(?&COMMONMAC))))
(?(DEFINE)(?<CISCOMAC>(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})))
(?(DEFINE)(?<WINDOWSMAC>(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})))
(?(DEFINE)(?<COMMONMAC>(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})))
(?(DEFINE)(?<IPV6>(?:((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?)))
(?(DEFINE)(?<IPV4>(?:(?<![0-9])(?:(?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5])[.](?:[0-1]?[0-9]{1,2}|2[0-4][0-9]|25[0-5]))(?![0-9]))))
(?(DEFINE)(?<IP>(?:(?&IPV6)|(?&IPV4))))
(?(DEFINE)(?<HOSTNAME>(?:\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b))))
(?(DEFINE)(?<IPORHOST>(?:(?&IP)|(?&HOSTNAME))))
(?(DEFINE)(?<HOSTPORT>(?:(?&IPORHOST):(?&POSINT))))
(?(DEFINE)(?<PATH>(?:(?&UNIXPATH)|(?&WINPATH))))
(?(DEFINE)(?<UNIXPATH>(?:(/[[[:alnum:]]_%!$@:.,+~-]*)+)))
(?(DEFINE)(?<TTY>(?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))))
(?(DEFINE)(?<WINPATH>(?:(?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+)))
(?(DEFINE)(?<URIPROTO>(?:[A-Za-z]([A-Za-z0-9+\-.]+)+)))
(?(DEFINE)(?<URIHOST>(?:(?&IPORHOST)(?::(?&POSINT)))))
(?(DEFINE)(?<URIPATH>(?:(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%&_\-]*)+)))
(?(DEFINE)(?<URIPARAM>(?:\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]<>]*)))
(?(DEFINE)(?<URIPATHPARAM>(?:(?&URIPATH)(?:(?&URIPARAM))?)))
(?(DEFINE)(?<URI>(?:(?&URIPROTO)://(?:(?&USER)(?::[^@]*)?@)?(?:(?&URIHOST))?(?:(?&URIPATHPARAM))?)))
(?(DEFINE)(?<MONTH>(?:\b(?:[Jj]an(?:uary|uar)?|[Ff]eb(?:ruary|ruar)?|[Mm](?:a|รค)?r(?:ch|z)?|[Aa]pr(?:il)?|[Mm]a(?:y|i)?|[Jj]un(?:e|i)?|[Jj]ul(?:y|i)?|[Aa]ug(?:ust)?|[Ss]ep(?:tember)?|[Oo](?:c|k)?t(?:ober)?|[Nn]ov(?:ember)?|[Dd]e(?:c|z)(?:ember)?)\b)))
(?(DEFINE)(?<MONTHNUM>(?:(?:0?[1-9]|1[0-2]))))
(?(DEFINE)(?<MONTHNUM2>(?:(?:0[1-9]|1[0-2]))))
(?(DEFINE)(?<MONTHDAY>(?:(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))))
(?(DEFINE)(?<DAY>(?:(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?))))
(?(DEFINE)(?<YEAR>(?:(?>\d\d){1,2})))
(?(DEFINE)(?<HOUR>(?:(?:2[0123]|[01]?[0-9]))))
(?(DEFINE)(?<MINUTE>(?:(?:[0-5][0-9]))))
(?(DEFINE)(?<SECOND>(?:(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?))))
(?(DEFINE)(?<TIME>(?:(?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9]))))
(?(DEFINE)(?<DATE_US>(?:(?&MONTHNUM)[/-](?&MONTHDAY)[/-](?&YEAR))))
(?(DEFINE)(?<DATE_EU>(?:(?&MONTHDAY)[./-](?&MONTHNUM)[./-](?&YEAR))))
(?(DEFINE)(?<ISO8601_TIMEZONE>(?:Z|[+-](?&HOUR)(?::?(?&MINUTE)))))
(?(DEFINE)(?<ISO8601_SECOND>(?:(?&SECOND)|60)))
(?(DEFINE)(?<TIMESTAMP_ISO8601>(?:(?&YEAR)-(?&MONTHNUM)-(?&MONTHDAY)[T ](?&HOUR):?(?&MINUTE)(?::?(?&SECOND))?(?&ISO8601_TIMEZONE)?)))
(?(DEFINE)(?<DATE>(?:(?&DATE_US)|(?&DATE_EU))))
(?(DEFINE)(?<DATESTAMP>(?:(?&DATE)[- ](?&TIME))))
(?(DEFINE)(?<TZ>(?:[APMCE][SD]T|UTC)))
(?(DEFINE)(?<DATESTAMP_RFC822>(?:(?&DAY) (?&MONTH) (?&MONTHDAY) (?&YEAR) (?&TIME) (?&TZ))))
(?(DEFINE)(?<DATESTAMP_RFC2822>(?:(?&DAY), (?&MONTHDAY) (?&MONTH) (?&YEAR) (?&TIME) (?&ISO8601_TIMEZONE))))
(?(DEFINE)(?<DATESTAMP_OTHER>(?:(?&DAY) (?&MONTH) (?&MONTHDAY) (?&TIME) (?&TZ) (?&YEAR))))
(?(DEFINE)(?<DATESTAMP_EVENTLOG>(?:(?&YEAR)(?&MONTHNUM2)(?&MONTHDAY)(?&HOUR)(?&MINUTE)(?&SECOND))))
(?(DEFINE)(?<SYSLOGTIMESTAMP>(?:(?&MONTH) (?&MONTHDAY) (?&TIME))))
(?(DEFINE)(?<PROG>(?:[\x21-\x5a\x5c\x5e-\x7e]+)))
(?(DEFINE)(?<SYSLOGPROG>(?:(?&PROG)(?:\[(?&POSINT)\])?)))
(?(DEFINE)(?<SYSLOGHOST>(?:(?&IPORHOST))))
(?(DEFINE)(?<SYSLOGFACILITY>(?:<(?&NONNEGINT).(?&NONNEGINT)>)))
(?(DEFINE)(?<HTTPDATE>(?:(?&MONTHDAY)/(?&MONTH)/(?&YEAR):(?&TIME) (?&INT))))
(?(DEFINE)(?<QS>(?:(?&QUOTEDSTRING))))
(?(DEFINE)(?<SYSLOGBASE>(?:(?&SYSLOGTIMESTAMP) (?:(?&SYSLOGFACILITY) )?(?&SYSLOGHOST) (?&SYSLOGPROG):)))
(?(DEFINE)(?<LOGLEVEL>(?:([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo?(?:rmation)?|INFO?(?:RMATION)?|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?))))