Explain Regex code

What this Regex sample shows

groups

(?P<ip>...) is a named group: after a match, m.group("ip") returns just that part of the line. (?:\.\d{1,3}) groups without capturing, so {3} can repeat it without adding a group.

quantifiers

\d{1,3} takes one to three digits and \S+ takes one or more characters that aren't spaces. (?P<bytes>\d+|-) takes either a number or a single -.

character classes

[^\]]+ is a negated class: a run of anything except ]. It stops at the first closing bracket, so the time can't run on into the rest of the line.

flags

re.VERBOSE ignores spaces in the pattern and lets each line end in a # comment, which is why the pattern can be laid out one field per line. So a space to match is written here as \s, which matches any whitespace.

Good to know

• Run on the sample line, the script prints /pricing 200 5123.
• \d{1,3} checks the shape of an address, not its value: 999.999.999.999 matches. Pass the ip group to Python's ipaddress.ip_address() when the address has to be real.
• The pattern only knows IPv4. A line from an IPv6 client, such as 2001:db8::1, doesn't match at all.
• match() already starts at the beginning of the string, so the ^ is there for the reader. The $ at the end is what makes the whole line required.

Watch out: This is the common log format. Nginx's default combined format adds the referrer and the user agent after the byte count, so the $ makes every one of those lines fail: match() returns None, and m.group(...) then raises AttributeError.