Use the metacharacters described in the table below when performing searches or creating rules:
| Metacharacter | Description |
|---|---|
| ^ | Anchors match to the beginning of a line or string |
| $ | Anchors match to the end of a line or string |
| abc | Matches all of a, b, and c in order |
| fee|fie|foe | Matches one of fee, fie, or foe |
| ^(?!fee|fie|foe) | Matches anything other than fee, fie, or foe |
| . | Matches any character except newline |
| x? | Matches 0 or 1 occurrences of x (x can be any character) |
| x* | Matches 0 or more occurrences of x |
| x+ | Matches 1 or more occurrences of x |
| x{m,n} | Matches at least m occurrences of x but no more than n |
| [a-z0-9] | Matches any single character of set |
| [^a-z0-9] | Matches any single character not in set |
| \d | Matches a digit, same as [0-9] |
| \D | Matches a non-digit, same as [^0-9] |
| \w | Matches an alphanumeric (word) character [a-zA-Z0-9_] |
| \W | Matches a non-word character [^a-zA-Z0-9_] |
| \s | Matches a whitespace character (space, tab, newline…) |
| \S | Matches a non-whitespace character |
| \metachar | Treat metacharacter as ordinary character; for example, \* matches the * character |
| (abc) | Remembers the match for later backreferences |
| \1 | Matches whatever first set of parens matched |
| \2 | Matches whatever second set of parens matched |
| \3 | and so on… |
| \b | Matches a word boundary (outside [] only) |
| \B | Matches a non-word boundary |
Tip: Use the ^ and $ metacharacters around values that may be part of other values. For example, a value of 5 without anchors will also match with 15, 250, etc. To prevent it from matching with other values, place anchors around it: ^5$.
Sometimes people ask the question how do I search for all the messages in the logs with the ID 2345234 in PID-3 – i.e. the third field of the PID (Patient Identification) segment.
It’s quite possible to do this with a regex expression although the recipe is a little non obvious which is why I show this tip here.
The trick is this fragment of a regex: “\|[^\|]*\|” -what does it mean?
It says match against a | character – we have to escape with \ since | is a special character in regex.
Then the [^\|]* means match against all the characters which follow which are *not* a | character.
So we can chain these together to skip past fields we are not interested in. So for instance to look for every PID segment where the 3rd field has the value 2345234 in it we can use:
/PID\|[^\|]+\|[^\|]+\|2345234/
You can book mark searches if you find yourself doing them often.
If you have trouble crafting recipes for other searches like this that you then do feel free to ask in this forum and we’ll be happy to give you an example of how to do it.
Pingback: Top Support Questions of March 2015 - iNTERFACEWARE Inc.