# Basic constructs
numberStr [+-]?(?>\d+(?:\.(?:\d*)?)?|\.\d+)
numberExtStr [+-]?(?>\d+(?:\.(?:\d*)?)?|\.\d+)(?:[eE][+-]?\d+)?
integerStr [+-]?\d+
integerExtStr [+-]?\d+(?:[eE][+-]?\d+)?
word \b\w+\b
doubleQuotedString "[^"]*"
singleQuotedString '[^']*'
quotedString (?>%{doubleQuotedString}|%{singleQuotedString})
qs %{quotedString}
uuid [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}
notSpace \S+
data .*?
greedyData .*
space \s+
# Username
user [\w.-]+
# Networking
# MAC addresses
ciscoMac (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})
windowsMac (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})
commonMac (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
mac (?:%{ciscoMac}|%{windowsMac}|%{commonMac})
# IP addresses
ipv6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?
ipv4 (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])
ip (?:%{ipv6}|%{ipv4})
# Hostname
# We allow underscores in hostnames (https://issues.apache.org/bugzilla/show_bug.cgi?id=21133)
hostname \b(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62}))*(\.?|\b)
host %{hostname}
# IP or host
ipOrHost (?:%{ip}|%{host})
# A port can be any value from 1 to 65535
port [1-9]\d{0,4}
hostPort %{ipOrHost}:%{port}
# Paths
path (?:%{unixPath}|%{winPath})
unixPath (?>/(?>[\w_%!$@:.,~-]+|\\.)*)+
tty (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
winPath (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+
uriProto [A-Za-z]+(?:\+[A-Za-z+]+)?
uriHost %{ipOrHost}(?::%{port})?
# Uripath comes loosely from RFC1738, but mostly from what Firefox
# doesn't turn into %XX
uriPath (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+
#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
uriParam \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*
uriPathParam %{uriPath}(?:%{uriParam})?
uri %{uriProto}://(?:%{user}(?::[^@]*)?@)?(?:%{uriHost})?(?:%{uriPathParam})?
# Log Levels
# LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)