Regular expression supportedit

Auditbeat regular expression support is based on RE2.

Before using a regular expression in the config file, refer to the documentation to verify that the option you are setting accepts a regular expression.

We recommend that you wrap regular expressions in single quotation marks to work around YAML’s string escaping rules. For example, '^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+'.

For more examples of supported regexp patterns, see Managing Multiline Messages. Although the examples pertain to Filebeat, the regexp patterns are applicable to other use cases.

The following patterns are supported:

Pattern Description

Single Characters


single character


any character


character class


negated character class


ASCII character class


negated ASCII character class


Perl character class


negated Perl character class


Unicode character class (one-letter name)


Unicode character class


negated Unicode character class (one-letter name)


negated Unicode character class



x followed by y


x or y (prefer x)



zero or more x


one or more x


zero or one x


n or n+1 or …​ or m x, prefer more


n or more x, prefer more


exactly n x


zero or more x, prefer fewer


one or more x, prefer fewer


zero or one x, prefer zero


n or n+1 or …​ or m x, prefer fewer


n or more x, prefer fewer


exactly n x



numbered capturing group (submatch)


named & numbered capturing group (submatch)


non-capturing group


set flags within current group, non-capturing


set flags during re, non-capturing


case-insensitive (default false)


multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)


let . match \n (default false)


ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)

Empty Strings


at beginning of text or line (m=true)


at end of text (like \z not \Z) or line (m=true)


at beginning of text


at ASCII word boundary (\w on one side and \W, \A, or \z on the other)


not at ASCII word boundary


at end of text

Escape Sequences


bell (same as \007)


form feed (same as \014)


horizontal tab (same as \011)


newline (same as \012)


carriage return (same as \015)


vertical tab character (same as \013)


literal *, for any punctuation character *


octal character code (up to three digits)


two-digit hex character code


hex character code


literal text ... even if ... has punctuation

ASCII Character Classes


alphanumeric (same as [0-9A-Za-z])


alphabetic (same as [A-Za-z])


ASCII (same as \x00-\x7F])


blank (same as [\t ])


control (same as [\x00-\x1F\x7F])


digits (same as [0-9])


graphical (same as [!-~] == [A-Za-z0-9!"#$%&'()*+,\-./:;<=>?@[\\\]^_` {|}~])


lower case (same as [a-z])


printable (same as [ -~] == [ [:graph:]])


punctuation (same as [!-/:-@[-`{-~])


whitespace (same as [\t\n\v\f\r ])


upper case (same as [A-Z])


word characters (same as [0-9A-Za-z_])


hex digit (same as [0-9A-Fa-f])

Supported Perl Character Classes


digits (same as [0-9])


not digits (same as [^0-9])


whitespace (same as [\t\n\f\r ])


not whitespace (same as [^\t\n\f\r ])


word characters (same as [0-9A-Za-z_])


not word characters (same as [^0-9A-Za-z_])