Step 1 – Provide a Sample Log

For example:

2026-10-01 13:42:17 user=admin src=203.0.113.50 action=login_failed
2026-10-01 13:43:02 user=test src=203.0.113.25 action=login_success

We want to extract:

timestamp
username
source IP
action

Step 2 – Ask AI for a Regex

Use:

Create a regular expression that extracts these fields
from the following log format:

timestamp
username
source IP
action

Example:

2026-10-01 13:42:17 user=admin src=203.0.113.50 action=login_failed

Use named capture groups if supported.
Explain each capture group.

AI can produce a regex designed specifically for that format.

Step 3 – Test Edge Cases

This is where the process becomes more useful.

Give AI additional examples:

Test the regex against these cases:

2026-10-01 13:44:00 user=administrator src=192.0.2.10 action=login_failed
2026-10-01 13:45:22 user=test-user src=192.0.2.20 action=login_success
2026-10-01 13:46:10 user=guest src=invalid action=login_failed

Identify which lines match and explain why.

You can then ask AI to improve the regex if necessary.

Step 4 – Use It in a Script

Once you’ve validated the pattern, you can use it in a Python or shell-based log-processing workflow.

For example, the extracted fields could become:

timestamp: 2026-10-01 13:42:17
user: admin
src: 203.0.113.50
action: login_failed

This makes the data easier to search, filter, or send into another security tool.

The Workflow

Raw Logs
   ↓
AI Generates Regex
   ↓
Test Against Examples
   ↓
Fix Edge Cases
   ↓
Extract Fields
   ↓
Security Analysis

The key is to test regex against realistic variations, not just the single example used to generate it. AI can get you to a working starting point quickly, while testing determines whether the pattern is actually reliable.