A production log has thousands of lines, but the incident report asks for every request that returned a 5xx status. A regular expression can narrow the search quickly—provided it matches the intended lines and avoids accidental ones.
For a simple log format such as “2026-11-07 10:42:19 GET /api/orders 503”, a starting pattern might be: \b5\d{2}\b. It captures three-digit status codes beginning with 5. That may be enough for a first pass, but test it against normal lines, malformed lines, and nearby values such as 200, 404, and 5030. The last one should not be mistaken for a standalone status.
Build the pattern from examples
Collect a handful of representative positive and negative samples. Decide whether matching should be case-sensitive, whether line breaks matter, and whether you need a full-line match or just a substring. Add anchors only when the input format is stable. If the expression grows hard to read, break it into named steps or use a parser for structured logs.
Toolaska Regex Tester provides a place to enter a pattern and sample text and inspect matches while iterating. Use small, safe examples first; do not paste secrets, access tokens, or personal data from production logs into an online tool. Redact before testing.
A regex is a compact filter, not a substitute for understanding the data format. Keep the test examples alongside the pattern so a future change to the logging format does not silently break your incident query.
Try a redacted sample: https://toolaska.com/regex-tester/
Top comments (0)