en	# 12 Regular expressions
zh-cn	# 12. 正则表达式

en	#### Overview [Perl Compatible Regular Expressions](https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions) (PCRE, PCRE2) are supported in Zabbix. There are two ways of using regular expressions in Zabbix: - manually entering a regular expression - using a global regular expression created in Zabbix
zh-cn	#### 概述 Zabbix支持 [Perl兼容正则表达式](https://en.wikipedia.org/wiki/Perl_Compatible_Regular_Expressions)（PCRE, PCRE2）。 Zabbix 中使用正则表达式有两种方式： - 手动输入正则表达式 - 使用在 Zabbix 中创建的全局正则表达式

en	#### Regular expressions You may manually enter a regular expression in supported places. Note that the expression may not start with @ because that symbol is used in Zabbix for referencing global regular expressions. ::: notewarning It's possible to run out of stack when using regular expressions. See the [pcrestack man page](http://pcre.org/original/doc/html/pcrestack.html) for more information. ::: Note that in multiline matching, the `^` and `$` anchors match at the beginning/end of each line respectively, instead of the beginning/end of the entire string. See also examples for [correct escaping](/manual/appendix/escaping) in various contexts.
zh-cn	#### 正则表达式 你可以在支持的位置手动输入正则表达式。注意，表达式可能不以 @ 开头，因为该符号在 Zabbix 中用于引用全局正则表达式。 ::: notewarning 使用正则表达式时可能会耗尽堆栈。有关更多信息，请参见 [pcrestack 帮助页](http://pcre.org/original/doc/html/pcrestack.html) 。 ::: 在多行匹配中，锚点 `^` 和 `$` 分别匹配每行的开头/结尾，而不是整个字符串的开头/结尾。

en	#### Global regular expressions There is an advanced editor for creating and testing complex regular expressions in Zabbix frontend. Once a regular expression has been created this way, it can be used in several places in the frontend by referring to its name, prefixed with @, for example, *\@mycustomregexp*. To create a global regular expression: - Go to: *Administration → General* - Select *Regular expressions* from the dropdown - Click on *New regular expression* The **Expressions** tab allows to set the regular expression name and add subexpressions. ![](../../assets/en/manual/regular_expressions/global_regexp.png) All mandatory input fields are marked with a red asterisk. |Parameter|<|Description| |-|----------|----------------------------------------| |*Name*|<|Set the regular expression name. Any Unicode characters are allowed.| |*Expressions*|<|Click on *Add* in the Expressions block to add a new subexpression.| | |*Expression type*|Select expression type:<br>**Character string included** - match the substring<br>**Any character string included** - match any substring from a delimited list. The delimited list includes a comma (,), a dot (.) or a forward slash (/).<br>**Character string not included** - match any string except the substring<br>**Result is TRUE** - match the regular expression<br>**Result is FALSE** - do not match the regular expression| |^|*Expression*|Enter substring/regular expression.| |*Delimiter*|<|A comma (,), a dot (.) or a forward slash (/) to separate text strings in a regular expression. This parameter is active only when "*Any character string included*" expression type is selected.| |*Case sensitive*|<|A checkbox to specify whether a regular expression is sensitive to capitalization of letters.| A forward slash (/) in the expression is treated literally, rather than a delimiter. This way it is possible to save expressions containing a slash, without errors. ::: noteimportant A custom regular expression name in Zabbix may contain commas, spaces, etc. In those cases where that may lead to misinterpretation when referencing (for example, a comma in the parameter of an item key) the whole reference may be put in quotes like this: *"\@My custom regexp for purpose1, purpose2"*.\ Regular expression names must not be quoted in other locations (for example, in LLD rule properties). ::: In the **Test** tab the regular expression and its subexpressions can be tested by providing a test string. ![](../../assets/en/manual/regular_expressions/global_regexp_b.png) Results show the status of each subexpression and total custom expression status. Total custom expression status is defined as *Combined result*. If several sub expressions are defined Zabbix uses AND logical operator to calculate *Combined result*. It means that if at least one Result is False *Combined result* has also False status.
zh-cn	#### 全局正则表达式 Zabbix 前端有一个用于创建和测试复杂正则表达式的高级编辑器。 一旦以这种方式创建了正则表达式，就可以在前端的多个位置通过引用其名称（以 @ 为前缀）使用它，例如 *\@mycustomregexp*。 创建全局正则表达式： - 点击 *Administration（管理） → General（一般）* - 从下拉列表中选择 *Regular expressions（正则表达式）* - 点击 *New regular expression（新建正则表达式）* **表达式** 选项卡允许设置正则表达式名称并添加子表达式。 ![](../../assets/en/manual/regular_expressions/global_regexp.png) 所有必填字段都标有红色星号。 |参数|<|描述| |---------|-|-----------| |*Name（名字）*|<|设置正则表达式名称。允许使用任何 Unicode 字符。| |*Expressions（表达式）*|<|单击表达式块中的 *Add（添加）* 以添加新的子表达式。| |<|*Expression type（表达式类型）*|选择表达式类型：<br>**Character string included（包含字符串）** - 匹配子字符串<br>**Any character string included（包含任何字符串）** - 匹配分隔列表中的任何子字符串。分隔列表包括逗号 （,）、点 （.）或正斜杠（/）。<br>**Character string not included（不包含字符串）** - 匹配除子字符串以外的任何字符串<br>**Result is TRUE（结果为 TRUE）** - 匹配正则表达式<br>**Result is FALSE（结果为 FALSE）** - 不匹配正则表达式| |^|*Expression（表达式）*|输入子字符串/正则表达式。| |*Delimiter（分隔符）*|<|逗号 (,)、点 (.) 或正斜杠 (/) 用于分隔正则表达式中的文本字符串。当选择“*包含任意字符串*”的表达式类型时，此参数才有效 。| |*Case sensitive（区分大小写）*|<|一个复选框，用于指定正则表达式对大小写字母的敏感性。| 表达式中的正斜杠 (/) 按字面意思处理，而不是分隔符。这样就可以保存包含斜杠的表达式而不会出错。 ::: noteimportant Zabbix 中的自定义正则表达式名称可能包含逗号、空格等。在那些可能导致引用时误解的情况下（例如，监控项键值参数中的逗号）整个引用可能会像这样放在引号中：*"\@My custom regexp for purpose1, purpose2"*。 正则表达式名称不得在其他位置引用（例如，在 LLD 规则属性中）。 ::: 在 **测试** 选项卡中，可以通过提供测试字符串来测试正则表达式及其子表达式。 ![](../../assets/en/manual/regular_expressions/global_regexp_b.png) 结果显示每个子表达式的状态和总的自定义表达式状态。 总自定义表达式状态定义为*组合结果*。如果定义了多个子表达式，Zabbix 使用 AND 逻辑运算符计算 *组合结果* 。这意味着如果至少一个 Result 为 False，*组合结果* 也为 False 状态。

en	#### Default global regular expressions Zabbix comes with several global regular expression in its default dataset. |Name|Expression|Matches| |--|------|------| |*File systems for discovery*|`^(btrfs|ext2|ext3|ext4|jfs|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|refs|apfs|ntfs|fat32|zfs)$`|"btrfs" or "ext2" or "ext3" or "ext4" or "jfs" or "reiser" or "xfs" or "ffs" or "ufs" or "jfs" or "jfs2" or "vxfs" or "hfs" or "refs" or "apfs" or "ntfs" or "fat32" or "zfs"| |*Network interfaces for discovery*|`^Software Loopback Interface`|Strings starting with "Software Loopback Interface".| | |`^lo$`|"lo"| | |`^(In)?[Ll]oop[Bb]ack[0-9._]*$`|Strings that optionally start with "In", then have "L" or "l", then "oop", then "B" or "b", then "ack", which can be optionally followed by any number of digits, dots or underscores.| | |`^NULL[0-9.]*$`|Strings starting with "NULL" optionally followed by any number of digits or dots.| | |`^[Ll]o[0-9.]*$`|Strings starting with "Lo" or "lo" and optionally followed by any number of digits or dots.| | |`^[Ss]ystem$`|"System" or "system"| | |`^Nu[0-9.]*$`|Strings starting with "Nu" optionally followed by any number of digits or dots.| |*Storage devices for SNMP discovery*|`^(Physical memory|Virtual memory|Memory buffers|Cached memory|Swap space)$`|"Physical memory" or "Virtual memory" or "Memory buffers" or "Cached memory" or "Swap space"| |*Windows service names for discovery*|`^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32)$`|"MMCSS" or "gupdate" or "SysmonLog" or strings like "clr\_optimization\_v2.0.50727\_32" and "clr\_optimization\_v4.0.30319\_32" where instead of dots you can put any character except newline.| |*Windows service startup states for discovery*|`^(automatic|automatic delayed)$`|"automatic" or "automatic delayed"|
zh-cn	#### 默认全局正则表达式 Zabbix在其默认数据集中提供了几个全局正则表达式。 |名字|表达式|匹配结果| |----|----------|-------| |*用于发现的文件系统*|`^(btrfs\|ext2\|ext3\|ext4\|jfs\|reiser\|xfs\|ffs\|ufs\|jfs\|jfs2\|vxfs\|hfs\|refs\|apfs\|ntfs\|fat32\|zfs)$`|"btrfs" 或 "ext2" 或 "ext3" 或 "ext4" 或 "jfs" 或 "reiser" 或 "xfs" 或 "ffs" 或 "ufs" 或 "jfs" 或 "jfs2" 或 "vxfs" 或 "hfs" 或 "refs" 或 "apfs" 或 "ntfs" 或 "fat32" 或 "zfs"| |*用于发现的网络接口*|`^Software Loopback Interface`|以 "Software Loopback Interface（软件环回接口）" 开头的字符串。| |<|`^lo$`|"lo"| |<|`^(In)?[Ll]oop[Bb]ack[0-9._]*$`|以 "In" 为开头，接着是 "L" 或 "l"，然后是 "oop"，然后 "B" 或 "b"，再然后 "ack" 组合的字符串。可以选择后跟任意数量的数字、点或下划线。| |<|`^NULL[0-9.]*$`|以 "NULL" 开头的后可选地跟任意数量的数字或点的字符串。| |<|`^[Ll]o[0-9.]*$`|以 "Lo" 或 "lo" 开头的后跟任意数量的数字或点的字符串。| |<|`^[Ss]ystem$`|匹配 "System" 或 "system"。| |<|`^Nu[0-9.]*$`|以 "Nu" 开头的后可选地跟任意数量的数字或点的字符串。| |*用于 SNMP 发现的存储设备*|`^(Physical memory\|Virtual memory\|Memory buffers\|Cached memory\|Swap space)$`|"Physical memory" 或 "Virtual memory" 或 "Memory buffers" 或 "Cached memory" 或 "Swap space"。| |*用于发现的 Windows 服务名称*|`^(MMCSS\|gupdate\|SysmonLog\|clr_optimization_v2.0.50727_32\|clr_optimization_v4.0.30319_32)$`|"MMCSS" 或 "gupdate" 或 "SysmonLog" 或类似于 "clr\_optimization\_v2.0.50727\_32" 和 "clr\_optimization\_v4.0.30319\_32" 的除了换行符之外可以放置​​任何字符代替点的字符串。| |*用于发现的 Windows 服务启动状态*|`^(automatic\|automatic delayed)$`|"automatic（自动）" 或 "automatic delayed（自动延迟）"。|

en	#### Examples
zh-cn	#### 示例

en	##### Example 1 Use of the following expression in low-level discovery to discover databases except a database with a specific name: ^TESTDATABASE$ ![regexp\_expr\_2.png](../../assets/en/manual/regular_expressions/regexp_expr_2.png) Chosen *Expression type*: "Result is FALSE". Doesn't match name, containing string "*TESTDATABASE*".
zh-cn	##### 示例1 在低级别自动发现中使用下列表达式发现具有特定名称的数据库以外的数据库： ^TESTDATABASE$ ![regexp\_expr\_2.png](../../assets/en/manual/regular_expressions/regexp_expr_2.png) 选择的 *Expression type（表达式类型）*：“Result is FALSE（结果为假）”。 与名称不匹配，包含字符串 "*TESTDATABASE*"。

en	##### Example with an inline regex modifier Use of the following regular expression including an inline modifier (?i) to match the characters "error": (?i)error ![regexp\_expr\_3a.png](../../assets/en/manual/regular_expressions/regexp_expr_3a.png) Chosen *Expression type*: "Result is TRUE". Characters "error" are matched.
zh-cn	##### 使用内联正则表达式修饰符的示例 使用以下正则表达式，包括一个内联修饰符 (?i) 来匹配字符 "error"： (?i)error ![regexp\_expr\_3a.png](../../assets/en/manual/regular_expressions/regexp_expr_3a.png) 选择的 *Expression type（表达式类型）*："Result is TRUE（结果为真）"。字符 "error" 被匹配。

en	##### Another example with an inline regex modifier Use of the following regular expression including multiple inline modifiers to match the characters after a specific line: (?<=match (?i)everything(?-i) after this line\n)(?sx).*# we add s modifier to allow . match newline characters ![regexp\_expr\_4\_new.png](../../assets/en/manual/regular_expressions/regexp_expr_4_new.png) Chosen Expression type: "Result is TRUE". Characters after a specific line are matched. ::: noteimportant **g** modifier can't be specified in line. The list of available modifiers can be found in [pcresyntax man page](https://www.pcre.org/original/doc/html/pcresyntax.html#SEC16). For more information about PCRE syntax please refer to [PCRE HTML documentation](https://www.pcre.org/original/doc/html/pcrepattern.html). :::
zh-cn	##### 另一个使用内联正则表达式修饰符的示例 使用以下包含多个内联修饰符的正则表达式来匹配特定行之后的字符： (?<=match (?i)everything(?-i) after this line\n)(?sx).*# we add s modifier to allow . match newline characters ![regexp\_expr\_4\_new.png](../../assets/en/manual/regular_expressions/regexp_expr_4_new.png) 选择的表达式类型："Result is TRUE（结果为真）"。匹配特定行之后的字符。 ::: noteimportant **g** 修饰符不能在行中指定。可用修饰符列表可以参考 [pcresyntax 手册页](https://www.pcre.org/original/doc/html/pcresyntax.html#SEC16)。有关 PCRE 语法的更多信息，请参阅 [PCRE HTML文档](https://www.pcre.org/original/doc/html/pcrepattern.html)。 :::

en	#### Regular expression support by location |Location|<|Regular expression|Global regular expression|Multiline matching|Comments| |-|----------|---------|---------|---------|--------------------| |**[Agent items](/manual/config/items/itemtypes/zabbix_agent)**|<|<|<|<|<| |<|eventlog\[\]|Yes|Yes|Yes|`regexp`, `severity`, `source`, `eventid` parameters| |<|eventlog.count\[\]|^|^|^|`regexp`, `severity`, `source`, `eventid` parameters| |^|log\[\]|^|^|^|`regexp` parameter| |^|log.count\[\]|^|^|^|^| |^|logrt\[\]|^|Yes/No|^|`regexp` parameter supports both, `file_regexp` parameter supports non-global expressions only| |^|logrt.count\[\]|^|^|^|^ |^|proc.cpu.util\[\]|^|No|No|`cmdline` parameter| |^|proc.get\[\]|^|^|^|^| |^|proc.mem\[\]|^|^|^|^| |^|proc.num\[\]|^|^|^|^| |^|sensor\[\]|^|^|^|`device` and `sensor` parameters on Linux 2.4| |^|system.hw.macaddr\[\]|^|^|^|`interface` parameter| |^|system.sw.packages\[\]|^|^|^|`regexp` parameter| |^|system.sw.packages.get\[\]|^|^|^|`regexp` parameter| |^|vfs.dir.count\[\]|^|^|^|`regex_incl`, `regex_excl`, `regex_excl_dir` parameters| |^|vfs.dir.get\[\]|^|^|^|`regex_incl`, `regex_excl`, `regex_excl_dir` parameters| |^|vfs.dir.size\[\]|^|^|^|`regex_incl`, `regex_excl`, `regex_excl_dir` parameters| |^|vfs.file.regexp\[\]|^|^|Yes|`regexp` parameter| |^|vfs.file.regmatch\[\]|^|^|^|^| |^|web.page.regexp\[\]|^|^|^|^| |**[SNMP traps](/manual/config/items/itemtypes/snmptrap)**|<|<|<|<|<| |<|snmptrap\[\]|Yes|Yes|No|`regexp` parameter| |**[Item value preprocessing](/manual/config/items/item#item_value_preprocessing)**|<|Yes|No|No|`pattern` parameter| |**[Functions for triggers/calculated items](/manual/appendix/functions)**|<|<|<|<|<| |<|count()|Yes|Yes|Yes|`pattern` parameter if `operator` parameter is *regexp* or *iregexp*| |<|countunique()|Yes|Yes|^|^| |<|find()|Yes|Yes|^|^| |^|logeventid()|Yes|Yes|No|`pattern` parameter| |^|logsource()|^|^|^|^| |**[Low-level discovery](/manual/discovery/low_level_discovery#discovery_rule_filter)**|<|<|<|<|<| |<|Filters|Yes|Yes|No|*Regular expression* field| |^|Overrides|Yes|No|^|In *matches*, *does not match* options for *Operation* conditions| |**[Action conditions](/manual/config/notifications/action/conditions)**|<|Yes|No|No|In *matches*, *does not match* options for *Host name* and *Host metadata* autoregistration conditions| |**[Scripts](/manual/web_interface/frontend_sections/alerts/scripts)**|<|Yes|Yes|No|*Input validation rule* field| |**[Web monitoring](/manual/web_monitoring#configuring_a_web_scenario)**|<|Yes|No|Yes|*Variables* with a **regex:** prefix<br>*Required string* field| |**[User macro context](/manual/config/macros/user_macros#user_macro_context)**|<|Yes|No|No|In macro context with a **regex:** prefix| |**[Macro functions](/manual/config/macros/macro_functions)**|<|<|<|<|<| |<|regsub()|Yes|No|No|`pattern` parameter| |^|iregsub()|^|^|^|^| |**[Link indicators in maps](/manual/config/visualization/maps/map#linking-elements)**|<|Yes|No|No|*Pattern* field (for text items)| |**[Icon mapping](/manual/web_interface/frontend_sections/administration/general#icon_mapping)**|<|Yes|Yes|No|*Expression* field| |**[Value mapping](/manual/config/items/mapping#configuration)**|<|Yes|No|No|*Value* field if mapping type is `regexp`|
zh-cn	#### 支持正则表达式的位置 |位置|<|正则表达式|全局正则表达式|多行匹配|注释| |--------|-|------------------|--------------------|-----|--------| |**[Agent 监控项](/manual/config/items/itemtypes/zabbix_agent)**|<|<|<|<|<| |<|eventlog\[\]|是|是|是|`regexp`, `severity`, `source`, `eventid` 参数| |^|eventlog.count\[\]|^|^|^|`regexp`, `severity`, `source`, `eventid` 参数| |^|log\[\]|^|^|^|`regexp` 参数| |^|log.count\[\]|^|^|^|^|^| |^|logrt\[\]|^|是/否|^|`regexp` 参数两者都支持，`file_regexp` 参数仅支持非全局表达式| |^|logrt.count\[\]|^|^|^|^| |^|proc.cpu.util\[\]|^|否|否|`cmdline` 参数| |^|proc.mem\[\]|^|^|^|^| |^|proc.num\[\]|^|^|^|^| |^|sensor\[\]|^|^|^|Linux 2.4的 `device` 和 `sensor` 参数 | |^|system.hw.macaddr\[\]|^|^|^|`interface` 参数| |^|system.sw.packages\[\]|^|^|^|`package` 参数| |^|vfs.dir.count\[\]|^|^|^|`regex_incl`, `regex_excl`, `regex_excl_dir` 参数| |^|vfs.dir.size\[\]|^|^|^|`regex_incl`, `regex_excl`, `regex_excl_dir` 参数| |^|vfs.file.regexp\[\]|^|^|^|`regexp` 参数| |^|vfs.file.regmatch\[\]|^|^|^|^| |^|web.page.regexp\[\]|^|^|^|^| |**[SNMP traps](/manual/config/items/itemtypes/snmptrap)**|<|<|<|<|<| |<|snmptrap\[\]|是|是|否|`regexp` 参数| |**[监控项值预处理](/manual/config/items/item#item_value_preprocessing)**|<|是|否|否|`pattern` 参数| |**[触发器函数/可计算监控项](/manual/appendix/functions)**|<|<|<|<|<| |<|count()|是|是|是|`pattern` 参数如果 `operator` 参数是 *regexp* 或 *iregexp*| |<|countunique()|是|是|^|^| |<|find()|是|是|^|^| |^|logeventid()|是|是|否|`pattern` 参数| |^|logsource()|^|^|^|^| |**[低级别自动发现](/manual/discovery/low_level_discovery#discovery_rule_filter)**|<|<|<|<|<| |<|Filters（过滤）|是|是|否|*正则表达式* 字段| |^|Overrides（覆盖）|是|否|^|在*Operation（操作）* 条件中 *matches（匹配）*、*does not match（不匹配）* 选项 | |**[动作条件](/manual/config/notifications/action/conditions)**|<|是|是|否|在 *Host name（主机名）* and *Host metadata（主机元数据）* 自动注册条件中 *matches（匹配）*、*does not match（不匹配）* 选项 | |**[脚本](/manual/web_interface/frontend_sections/alerts/scripts)**|<|是|是|否|*输入验证规则*字段| |**[Web 监控](/manual/web_monitoring#configuring_a_web_scenario)**|<|是|否|否|以 **regex:** 为前缀的变量 <br>*Required string（需要字符串）* 字段| |**[用户宏上下文](/manual/config/macros/user_macros#user_macro_context)**|<|是|否|否|在宏的上下文中带有 **regex:** 前缀| |**[宏函数](/manual/config/macros/macro_functions)**|<|<|<|<|<| |<|regsub()|是|否|否|`pattern` 参数| |^|iregsub()|^|^|^|^| |**[图标映射](/manual/web_interface/frontend_sections/administration/general#icon_mapping)**|<|是|是|*Expression* field| |**[值映射](/manual/config/items/mapping#configuration)**|<|是|否|否|*Value（值）* 字段如果值映射是`regexp`|