I need help about regex "invalid key error"

[hakanozanlagan]

hi,
i am using below key config for catch http status codes. when I click to update getting below error. when I use a simple recex code ("\s\d\d\d\s" ) configuration updated succesfully.

key = log[/var/log/httpd/access_log,"^(\S*).*\[(.*)\]\s"(\S*)\s(\S*)\s([^"]*)"\s(\S*)\s(\S*)\s"([^"]*)"\s"([^"]*)",,,skip,\6,,]

error = Invalid key "log[/var/log/httpd/access_log,"^(\S*).*\[(.*)\]\s"(\S*)\s(\S*)\s([^"]*)"\s(\S*)\s(\S*)\s"([^"]*)"\s"([^"]*)",,,skip,\6,,]" for item "log-apache-http-status-codes" on "LNX-zbxaph01.eduenv.com": incorrect syntax near "(\S*)\s(\S*)\s([^"]*)"\s(\S*)\s(\S*)\s"([^"]*)"\s" ...".

regex code working without any problem at regex101.com.

https://regex101.com/r/eLLs4O/1

[ISiroshtan]

The answer is pretty simple: you need to escape all double quote characters inside of your regexp. So it should end up like:

"\S*).*\[(.*)\]\s\"(\S*)\s(\S*)\s([^\"]*)\"\s(\S*)\s(\S*)\s\"([^\"]*)\"\s\"([^\"]*)\"

Also, question here would be: do you really need that complicated regexp? What kind of message in access log does it actually filter out? I mean, you not verifying data integrity, you using regexp to filter out what to fetch and what not.

If you want to take all message, just don't use regexp at all and it will be fetching all the records. And if you do actually filter some out, I'm pretty sure you can write regexp with specific criteria to filter out un-desired messages rather then define exact structure of the whole message. I.e.:

To only fetch GET or POST requests

"(GET|POST)"

To only fetch GET or POST requests with specific reply code family

"(GET|POST).*?\" (20.|40.)"

etc.

[hakanozanlagan]

Actualy the method that I used I learned from an udemy course. the instructor splitted logs into groups and select return code at output section with "\x". You are right, I was need only return codes with error. So I used below syntax. this solved my problem.
"\s([4,5]\d\d)\s"
thank you for your Help .