← GalleryMikroTik FireWall✨ Emoji Combos/.+HappyMK\s?(?<action>\S+)\s(?<chain>\w+):\sin:(?<int_in>\S+)\sout:(?<int_out>\S+), src-mac\s(?<src_mac>\S+),\sproto\s(?<prot>\w+)(\s(?<flags>\S+),|,)\s(?<src_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_port>\d+)->(?<dest_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<dest_port>\d+),(\s(?<NAT>\w+)\s\((?<src_nat_localip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_nat_local_port>\d+)->(?<src_nat_public_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<src_nat_public_port>\d+)\)->(?<dest_nat_ip>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?<dest_nat_port>\d+),)?(\sprio\s(?<prio>\d+->\d+),)?\slen\s(?<len>\d+)/PCRE+1011 years ago✓ Pre-loaded
About this regex
Parses MikroTik RouterOS firewall log lines (from the 'HappyMK' ruleset), capturing named groups for action, chain, in/out interfaces, source MAC, protocol, TCP flags, source and destination IP:port pairs, optional NAT translation details (src-nat and dst-nat addresses/ports), packet priority, and length. Ideal for syslog ingestion, SIEM pipelines, and monitoring or analyzing traffic on MikroTik devices.
