Regular Expression Supportedit

Topbeat supports a subset of the regular expression syntax accepted by RE2. Because we use the POSIX implementation, some patterns are currently not supported.

We recommend that you wrap regular expressions in single quotation marks to work around YAML’s string escaping rules. For example, '^\[?[0-9][0-9]:?[0-9][0-9]|^[[:graph:]]+'.

For more examples of supported regexp patterns, see Managing Multiline Messages. Although the examples pertain to Filebeat, the regexp patterns are applicable to other use cases.

Supported Patternsedit

The following patterns are supported:

Pattern Description

Single Characters


single character


any character


character class


negated character class


ASCII character class


negated ASCII character class



x followed by y


x or y (prefer x)



zero or more x


one or more x


zero or one x


n or n+1 or …​ or m x, prefer more


n or more x, prefer more


exactly n x


zero or more x, prefer fewer


one or more x, prefer fewer


zero or one x, prefer zero


n or n+1 or …​ or m x, prefer fewer


n or more x, prefer fewer


exactly n x



numbered capturing group (submatch)

Empty Strings


at beginning of text or line (m=true)


at end of text (like \z not \Z) or line (m=true)

Escape Sequences


bell (same as \007)


form feed (same as \014)


horizontal tab (same as \011)


newline (same as \012)


carriage return (same as \015)


vertical tab character (same as \013)


literal *, for any punctuation character *


octal character code (up to three digits)


two-digit hex character code


hex character code

ASCII Character Classes


alphanumeric (same as [0-9A-Za-z])


alphabetic (same as [A-Za-z])


ASCII (same as \x00-\x7F])


blank (same as [\t ])


control (same as [\x00-\x1F\x7F])


digits (same as [0-9])


graphical (same as [!-~] == [A-Za-z0-9!"#$%&'()*+,\-./:;<=>?@[\\\\]^_` {|}~])


lower case (same as [a-z])


printable (same as [ -~] == [ [:graph:]])


punctuation (same as [!-/:-@[-`{-~])


whitespace (same as [\t\n\v\f\r ])


upper case (same as [A-Z])


word characters (same as [0-9A-Za-z_])


hex digit (same as [0-9A-Fa-f])

Unsupported Patternsedit

The following patterns are not supported.

Pattern Description

Unsupported Single Characters


Perl character class


negated Perl character class


Unicode character class (one-letter name)


Unicode character class


negated Unicode character class (one-letter name)


negated Unicode character class

Unsupported Grouping


named & numbered capturing group (submatch)


non-capturing group


set flags within current group, non-capturing


set flags during re, non-capturing


case-insensitive (default false)


multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)


let . match \n (default false)


ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)

Unsupported Empty Strings


at beginning of text


at ASCII word boundary (\w on one side and \W, \A, or \z on the other)


not at ASCII word boundary


at end of text

Unsupported Escape Sequences


match a single byte even in UTF-8 mode


literal text ... even if ... has punctuation

Unsupported Perl Character Classes


digits (same as [0-9])


not digits (same as [^0-9])


whitespace (same as [\t\n\f\r ])


not whitespace (same as [^\t\n\f\r ])


word characters (same as [0-9A-Za-z_])


not word characters (same as [^0-9A-Za-z_])