← GalleryMikrotik Regex Firewall Log Golang✨ Emoji Combos`^.+>[\d]\s(?P<Date>\d{4}-\d{2}-\d{2})T(?P<Time>\d{2}:\d{2}:\d{2}).+firewall,info\s(?P<RadUser>\d+).+in:(?P<InputInterface>[^,]+)\s+out:(?P<OutputInterface>[^,]+),\s+(?:src-mac\s+(?P<SourceMacAddress>[^,]+),\s+)?proto\s+(?P<Protocol>\w+)(?:\s+\((?P<Flags>[^)]+)\))?,\s+\[?(?P<SrcIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<SrcPort>\d+))?->\[?(?P<DstIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|[a-f\d:]+)\]?(?::(?P<DstPort>\d+))?,\s(?P<NAT>\w+)\s\((?P<SrcIpLocalNat>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?P<SrcPortLocalNat>\d+)->(?P<SrcIpPublicNat>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?P<SrcPortPublicNat>\d+)\)->(?P<DestIpNat>\b(?:\d{1,3}\.){3}\d{1,3}\b):(?P<DestPortNat>\d+),.+`Go+04 years ago✓ Pre-loaded
About this regex
Parses MikroTik RouterOS firewall log entries in Go, using named capture groups to extract structured fields. Captures date/time, user ID, input/output interfaces, optional source MAC, protocol, TCP flags, source/destination IPs (IPv4 or IPv6) with ports, and full NAT translation details (local->public->destination). Ideal for log ingestion, security monitoring, or building network analytics pipelines from MikroTik syslog output.
