Pattern library / Dev & Logs
Log Level Regex (DEBUG / INFO / WARN / ERROR / FATAL)
Every log format differs, but the level token is nearly always one of five words in brackets, dashes or pipes: 2026-10-28 14:30:01 ERROR something failed. One pattern with an alternation handles the common layouts — use it in grep, log shippers, or as the filter behind a dashboard widget.
\b(DEBUG|INFO|WARN|WARNING|ERROR|ERR|FATAL|CRITICAL)\bLoad this pattern into the tester →
How the pattern works
\bword boundaries stop partial hits likeINFOGRAPHICorERROR_RATE(underscore is a word char, soERROR_RATEis correctly not matched as a level — check your data: if levels sit next to_, swap\bfor(?=[^a-zA-Z]|$)).- The alternation covers common aliases: WARNING/ERR/CRITICAL next to their short forms.
- Anchored-line version for strict pipelines:
^(.*\s)?(DEBUG|INFO|WARN|ERROR|FATAL)(\s.*)?$— captures the level as group 2. - Timestamp + level extraction together:
^([0-9-]+ [0-9:,]+) (DEBUG|INFO|WARN|ERROR|FATAL)→ group 1 time, group 2 level.
Test it: match & no-match examples
Every row is loaded straight into the tester — click Try to see the match live:
| Input | Result | Why | |
|---|---|---|---|
2026-10-28 14:30:01 ERROR db timeout after 30s | Match | severity found | Try → |
[WARN] cache miss ratio 82% | Match | bracketed level | Try → |
level=info msg="server started" | No match | lowercase level — needs i flag (see pitfalls) | Try → |
DEBUG verbose worker tick | Match | plain prefix | Try → |
an error occurred (handled) | No match | lowercase prose — see pitfalls | Try → |
2026-10-28 INFO_OK done | No match | _glued — no word boundary | Try → |
Where to use it
Bash (errors only)
grep -E '\b(DEBUG|INFO|WARN|ERROR|FATAL)\b' app.log | grep -Ev '\b(DEBUG|INFO)\b' # warn+ only
JavaScript (log viewer filter)
const LEVEL = /\b(DEBUG|INFO|WARN|WARNING|ERROR|ERR|FATAL|CRITICAL)\b/; lines.filter(l => /\b(ERROR|FATAL|CRITICAL)\b/.test(l));
BigQuery (structured logs)
SELECT REGEXP_EXTRACT(message, r'\b(DEBUG|INFO|WARN|ERROR|FATAL)\b') AS level,
COUNT(*) FROM logs GROUP BY 1
Common mistakes
- Lowercase level strings (
error) need theiflag — many JSON loggers emit lowercase. \baround hyphenated or bracketed levels is fine, but if levels are glued ([ERROR]:), the boundary still holds — brackets are non-word chars.- Do not use this to compare severity (WARN worse than INFO) — severity ordering belongs in code, not in one regex.
FAQ
How do I match only ERROR-level lines?
Tighten the alternation: \b(ERROR|FATAL|CRITICAL)\b — or anchor the whole line: ^.*\bERROR\b.*$ for grep -E.
Why doesn't ERROR_RATE match?
Word boundaries — _ is a word character, so ERROR in ERROR_RATE has no boundary after it. That protects you from false hits; drop \b if you really want substring matches.
How do I capture the timestamp and level together?
^([0-9-]+ [0-9:,]+) (DEBUG|INFO|WARN|ERROR|FATAL) — group 1 is the time, group 2 the level. Adjust the time part to your log format.
Related patterns
ISO 8601 DateTime Regex — Match & Test Online · Quoted String Regex — Match "..." and '...' · IPv4 Address Regex — Validate Dots & Octets
For GA4-specific patterns, see the GA4 regex cheat sheet, the page path regex guide, the event filter regex guide, the GA4 regex match types, the custom channel grouping guide and RE2 vs PCRE. Browse the full regex pattern library.