Regex patterns

Regex patterns teach Logswarm how to split a log line into named columns. Create them under Settings → Regex, then assign a pattern to each directory location (or preset) you care about.

Required pieces

1. Extraction regex with at least one capturing group (...)
2. A name for each group (becomes a column / Complex field)
3. Exactly one group marked Timestamp
4. Timestamp date format using Java-style tokens (e.g. yyyy-MM-dd HH:mm:ss,SSS)

Optional: Boundary regex for multi-line records.

Example 1 — Java / Log4j-style application log

Sample line:

2026-07-06 12:21:37,393 INFO pl.npesystem.service.consumer [JMSConsumer-339] Sending message to queue, message {"id":1234567890}

Extraction regex:

^(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3})\s+([A-Z]+)\s+([\w\.]+)\s+(\[.*?\])\s+(.*)$

Timestamp date format:

yyyy-MM-dd HH:mm:ss,SSS

After assignment, column filters can target level=INFO, thread containing 339, etc.

Complex mode example

With that pattern assigned:

1. Select the directory/preset in Search in.
2. Switch to Complex → Edit groups.
3. Set level = ERROR and logger = SingleConsumer (substring).
4. Apply, then Search.

Within one group, OR with ||, e.g. level = ERROR || WARN.

Example 2 — Nginx-style access log (ISO-ish time)

Sample line:

2026-07-06T14:21:06+02:00 10.0.0.12 "GET /health HTTP/1.1" 200 15

Extraction regex:

^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+\-]\d{2}:\d{2})\s+(\S+)\s+"([A-Z]+)\s+([^"]+)"\s+(\d{3})\s+(\d+)$

Timestamp date format (adjust if your offset/format differs):

yyyy-MM-dd'T'HH:mm:ssXXX

If parsing fails for your exact timestamp variant, tighten the capturing group and format tokens until a sample value parses — unparseable timestamps still appear but sort last.

Assign the pattern

1. Save the pattern under Regex.
2. Open Directories → edit a location → set Regex pattern to your pattern (not None (legacy parser)).
3. Or set a pattern on a Preset when that fits your workflow.
4. Run a search and confirm columns appear; then use column filters.

Tips

• Prefer named, stable group names (level, not group_2) — they show up in Complex mode and filters.
• Keep the timestamp group’s text format aligned with Timestamp date format.
• Use non-capturing groups (?:...) for parts you do not want as columns.
• Invalid regex blocks save; the form requires at least one capturing group.

Related

• Configuration
• Search
• Column filters