I'm struggling to create a regex for Apache logs. It's for ignoreregex on Fail2ban.

I'd really like to be able to put something like /house to catch all files in that directory or /house/jonross.html specifically to match just that HTML file. The log format I'm using is below.

The field is the one where /city/index.html is in this example.

66-121-89-14.domain.com - - [14/Apr/2011:14:47:05 +0100] "GET /city/index.html HTTP/1.1" 200 2577 "http://www.domain.com/referrer/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv: Gecko/20110319 Firefox/3.6.16"

Can a regex whizz please help ?


After several hours of trial and hour, in case it helps someone else, this will ignore any directory after the slash after GET with these words:

ignoreregex = .*\"GET \/(city|house|anything).*

  • You might want to match HEAD and other HTTP methods, using (GET|HEAD|...)
    – JigglyNaga
    Jun 21 '16 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.