How do I read the groups in a match?

Parentheses create capture groups. The first set is group 1, the next is group 2, and so on. Named groups use a question mark and angle brackets in JavaScript.

Free tools · Security

Log and regex playground

Paste a log, write a pattern, and see exactly what matches. The count, the highlight and the capture groups come from the same result.

Pattern and text

2 matches

Regular expression

g is always on in the playground.

Log text

Oct 19 09:12:44 web01 sshd[412]: Failed password for invalid user admin from 203.0.113.44 port 51122 ssh2
Oct 19 09:12:51 web01 sshd[412]: Failed password for invalid user admin from 203.0.113.44 port 51130 ssh2
Oct 19 09:13:02 web01 sshd[412]: Accepted password for deploy from 198.51.100.8 port 40222 ssh2
Oct 19 09:14:10 api01 nginx: 198.51.100.8 - - "GET /v1/orders?id=42 HTTP/1.1" 200 8842
Oct 19 09:14:18 api01 nginx: 203.0.113.44 - - "GET /admin/config.php HTTP/1.1" 404 153
Oct 19 09:15:02 api01 nginx: 203.0.113.44 - - "POST /login HTTP/1.1" 401 221

First matches

at 33Failed password for invalid user admin from 203.0.113.44groups: 203.0.113.44
at 139Failed password for invalid user admin from 203.0.113.44groups: 203.0.113.44

Practice this in the app

Free to start. No card.

Read the log analysis lessonCySA+ path: reading evidence Try a log triage labFind the signal in a noisy log

Questions

Logs are text, and the interesting part is usually a small slice: an IP, a username, a path, a status code. A regular expression pulls that slice out consistently so you can count, group and compare it. Detection rules, parsers and SIEM queries all rely on the same skill.

Reading logs is a practiced skill

CySA+ and Security+ scenarios hand you evidence and a clock. SecLern labs start with a clear pattern and fade the hints until you can triage alone.

Start studying free

Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.