Quantifiers
Quantifiers specify how many times a pattern element can repeat. They are useful for matching variable-length parts of logs such as IDs, timestamps, numeric values, and stack traces.
Basic Quantifiers
a?
|
Zero or one "a" (optional) |
a*
|
Zero or more "a"s |
a+
|
One or more "a"s |
Log Analysis Examples
Optional log level indicator
.*\[ERROR\]?\s+Connection.*Matches "Connection" with or without "[ERROR]" prefix
Zero or more spaces
.*key:\s*value.*Matches "key:value", "key: value", "key: value"
One or more digits (memory, IDs, counts)
.*memory usage: \d+ MB.*Matches "memory usage: 512 MB", "memory usage: 1024 MB"
Specific Quantities
For precise control over repetition:
a{N}
|
Exactly N times "a" |
a{N,}
|
At least N times "a" |
a{N,M}
|
Between N and M times "a" |
Log Analysis Examples
Exactly 4 digits (years)
.*\d{4}-\d{2}-\d{2}.*Matches dates like "2024-01-15"
Exactly 12 hex chars (Docker container ID short form)
.*container [0-9a-f]{12}.*Matches "container a1b2c3d4e5f6"
At least 3 digits (large memory values)
.*allocated \d{3,} MB.*Matches allocations of 100MB or more
Between 1 and 3 digits (HTTP status codes)
.*HTTP/\d\.\d\" \d{3}.*Matches valid HTTP response codes (100-599)
Greedy vs Lazy Matching
By default, quantifiers are greedy and try to match as much as possible. That matters when you are building patterns around captures or delimiters:
# Greedy: Matches as much as possible
.*error.*
# On: "2024-01-15 ERROR disk full ERROR recovery failed"
# Matches the entire linePrefer delimiters or negated character classes when you need a match to stop at a clear boundary:
Specific delimiters prevent over-matching
# Instead of greedy matching everything
.*message: (.*) code:.*
# Use specific character class
.*message: ([^,]*) code:.*The negated class stops at the first comma.
Common Log Patterns with Quantifiers
Match IPv4 addresses
.*(\d{1,3}\.){3}\d{1,3}.*Matches IP addresses (1-3 digits per octet)
Match request duration in milliseconds
.*took \d+ms.*Matches "took 45ms", "took 1200ms"
Match stack trace lines
.*at [a-zA-Z_.]+\([a-zA-Z]+\.java:\d+\).*Matches Java stack trace entries
Match UUIDs
.*[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}.*Matches standard UUID format
Quantifier Performance
Be cautious with nested quantifiers:
# Potentially slow - nested repetition
.*(.*error.*){3,}.*
# Better - more specific
.*error.*error.*error.*Next Steps
Quantifiers become more powerful when combined with grouping . Learn about Groups & Alternation .