DEV Community

Discussion on: How To Build A RegEx

Collapse
 
benaryorg profile image
#benaryorg

Three days later or something I discovered that fail2ban is stripping out the date entirely.

Ended up using the following:

^\[(^[^\]]./.../....:..:..:..\s.....\)?]\s[^\s]+\s[^\s]+\s[^\s]+\s(<HOST>)\s

Which is basically halfway optimised.
I still keep matching the exact pattern of the date, except that I declare the content to be completely optional.
As this could potentially result in a valid match when the first dot matches the closing bracket, I replaced the first dot by a "not ]" expression.
This also yield faster speeds as the optional pattern immediately fails at the first character and can then is forced to try to not match the optional part.