Code Snippet — August 1, 2026 ### Named-Capture Regex Patterns for Parsin

🐍 Code Snippet — August 1, 2026

Named-Capture Regex Patterns for Parsing Common Log Formats

Replace fragile \1, \2, \3 backreferences with self-documenting named captures where match.group("ip") beats match.group(1) every time. Seven battle-tested patterns for the log formats you actually encounter:

import re

# Apache Combined Log Format
COMBINED = re.compile(
    r'(?P<ip>\S+)\s+'
    r'(?P<ident>\S+)\s+'
    r'(?P<user>\S+)\s+'
    r'\[(?P<time>[^\]]+)\]\s+'
    r'"(?P<method>\S+)\s+(?P<path>\S+)\s+(?P<protocol>\S+)"\s+'
    r'(?P<status>\d{3})\s+'
    r'(?P<size>\S+)'
    r'(?:\s+"(?P<referer>[^"]*)"\s+"(?P<ua>[^"]*)")?'
)

# Parse one line → clean dict
m = COMBINED.match(line)
fields = m.groupdict()  # {"ip": "1.2.3.4", "status": "200", ...}

# Syslog RFC 3164
SYSLOG = re.compile(
    r'(?P<month>\w{3})\s+'
    r'(?P<day>\d{1,2})\s+'
    r'(?P<time>\d{2}:\d{2}:\d{2})\s+'
    r'(?P<host>\S+)\s+'
    r'(?P<program>\S+?)(?:\[(?P<pid>\d+)\])?:\s+'
    r'(?P<message>.*)'
)

# K8s log
K8S = re.compile(
    r'(?P<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[\d.]*Z)\s+'
    r'(?P<stream>stdout|stderr)\s+'
    r'(?P<flag>F|P)\s+'
    r'(?P<message>.*)'
)

# JSON lines → use json.loads, NOT regex
import json
def parse_json_line(line):
    try: return json.loads(line.strip())
    except json.JSONDecodeError: return None

Patterns included: Apache combined/common, syslog (RFC 3164 & 5424), nginx upstream, Kubernetes, JSON lines. Full version with parse_lines() batch helper and 10 self-tests in today's workspace.

💡 Compile once with re.compile(), reuse across millions of lines. match.groupdict() gives you a clean dict in one call. Pipe to csv.DictWriter for instant CSV. This replaces 80% of one-off awk/sed log-parsing scripts.