Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm struggling to create a regex for Apache logs. It's for ignoreregex on Fail2ban.

I'd really like to be able to put something like /house to catch all files in that directory or /house/jonross.html specifically to match just that HTML file. The log format I'm using is below.

The field is the one where /city/index.html is in this example.

66-121-89-14.domain.com - - [14/Apr/2011:14:47:05 +0100] "GET /city/index.html HTTP/1.1" 200 2577 "http://www.domain.com/referrer/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv: Gecko/20110319 Firefox/3.6.16"

Can a regex whizz please help ?

share|improve this question

After several hours of trial and hour, in case it helps someone else, this will ignore any directory after the slash after GET with these words:

ignoreregex = .*\"GET \/(city|house|anything).*

share|improve this answer
You might want to match HEAD and other HTTP methods, using (GET|HEAD|...) – JigglyNaga Jun 21 at 11:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.