This article provides an overview of regular expression syntax supported by Kusto Query Language (KQL), which is the syntax of the RE2 library.
There are a number of KQL operators and functions that perform string matching, selection, and extraction with regular expressions, such as matches regex, parse, and replace_regex().
In KQL, regular expressions must be encoded as string literals and follow the string quoting rules. For example, the RE2 regular expression \A is represented in KQL as "\\A". The extra backslash indicates that the other backslash is part of the regular expression \A.
Syntax overview
The following table overviews RE2 regular expression syntax, which is used to write regular expressions in Kusto.
Syntax element
Description
Single literals
Single characters match themselves, except for metacharacters (* + ? ( ) |), which have unique meanings as described in the following rows.
Metacharacters
To match a metacharacter literally, escape it with backslashes. For example, the regular expression \+ matches a literal plus (+) character.
Alternation
Alternate two expressions with | to create a new expression that matches either of the expressions. For example, e1 | e2 matches either e1 or e2.
Concatenation
Concatenate two expressions to create a new expression that matches the first expression followed by the second. For example, e1e2 matches e1 followed by e2.
Repetition
Metacharacters ?, +, and * are repetition operators. For example, e1? matches zero or one occurrence of e1, e1+ matches one or more occurrences of e1, and e1* matches a sequence of zero or more, possibly different, strings that match e1.
Note
Regular expression operators evaluate in this order: alternation (|), concatenation (side-by-side expressions), and repetition (?, +, *). Use parentheses to control the evaluation order.
Single-character expressions
Example
Description
.
any character, possibly including newline (s=true)
Implementation restriction: The counting forms x{n,m}, x{n,}, and x{n} reject forms that create a minimum or maximum repetition count above 1000. Unlimited repetitions aren't subject to this restriction.
Possessive repetitions
Example
Description
x*+
zero or more x, possessive (NOT SUPPORTED)
x++
one or more x, possessive (NOT SUPPORTED)
x?+
zero or one x, possessive (NOT SUPPORTED)
x{n,m}+
n or ... or mx, possessive (NOT SUPPORTED)
x{n,}+
n or more x, possessive (NOT SUPPORTED)
x{n}+
exactly nx, possessive (NOT SUPPORTED)
Grouping
Example
Description
(re)
numbered capturing group (submatch)
(?P<name>re)
named & numbered capturing group (submatch)
(?<name>re)
named & numbered capturing group (submatch) (NOT SUPPORTED)
(?'name're)
named & numbered capturing group (submatch) (NOT SUPPORTED)
(?:re)
noncapturing group
(?flags)
set flags within current group; noncapturing
(?flags:re)
set flags during re; noncapturing
(?#text)
comment (NOT SUPPORTED)
(?\|x\|y\|z)
branch numbering reset (NOT SUPPORTED)
(?>re)
possessive match of re (NOT SUPPORTED)
re@>
possessive match of re (NOT SUPPORTED) VIM
%(re)
noncapturing group (NOT SUPPORTED) VIM
Flags
Example
Description
i
case-insensitive (default false)
m
multi-line mode: ^ and $ match begin/end line in addition to begin/end text (default false)
s
let . match \n (default false)
U
ungreedy: swap meaning of x* and x*?, x+ and x+?, etc (default false)
Flag syntax is xyz (set) or -xyz (clear) or xy-z (set xy, clear z).
Empty strings
Example
Description
^
at beginning of text or line (m=true)
$
at end of text (like \z not\Z) or line (m=true)
\A
at beginning of text
\b
at ASCII word boundary (\w on one side and \W, \A, or \z on the other)
\B
not at ASCII word boundary
\g
at beginning of subtext being searched (NOT SUPPORTED) PCRE
\G
at end of last match (NOT SUPPORTED) PERL
\Z
at end of text, or before newline at end of text (NOT SUPPORTED)
\z
at end of text
(?=re)
before text matching re (NOT SUPPORTED)
(?!re)
before text not matching re (NOT SUPPORTED)
(?<=re)
after text matching re (NOT SUPPORTED)
(?<!re)
after text not matching re (NOT SUPPORTED)
re&
before text matching re (NOT SUPPORTED) VIM
re@=
before text matching re (NOT SUPPORTED) VIM
re@!
before text not matching re (NOT SUPPORTED) VIM
re@<=
after text matching re (NOT SUPPORTED) VIM
re@<!
after text not matching re (NOT SUPPORTED) VIM
\zs
sets start of match (= \K) (NOT SUPPORTED) VIM
\ze
sets end of match (NOT SUPPORTED) VIM
\%^
beginning of file (NOT SUPPORTED) VIM
\%$
end of file (NOT SUPPORTED) VIM
\%V
on screen (NOT SUPPORTED) VIM
\%#
cursor position (NOT SUPPORTED) VIM
\%'m
mark m position (NOT SUPPORTED) VIM
\%23l
in line 23 (NOT SUPPORTED) VIM
\%23c
in column 23 (NOT SUPPORTED) VIM
\%23v
in virtual column 23 (NOT SUPPORTED) VIM
Escape sequences
Example
Description
\a
bell (≡ \007)
\f
form feed (≡ \014)
\t
horizontal tab (≡ \011)
\n
newline (≡ \012)
\r
carriage return (≡ \015)
\v
vertical tab character (≡ \013)
\*
literal *, for any punctuation character *
\123
octal character code (up to three digits)
\x7F
hex character code (exactly two digits)
\x{10FFFF}
hex character code
\C
match a single byte even in UTF-8 mode
\Q...\E
literal text ... even if ... has punctuation
\1
backreference (NOT SUPPORTED)
\b
backspace (NOT SUPPORTED) (use \010)
\cK
control char ^K (NOT SUPPORTED) (use \001 etc)
\e
escape (NOT SUPPORTED) (use \033)
\g1
backreference (NOT SUPPORTED)
\g{1}
backreference (NOT SUPPORTED)
\g{+1}
backreference (NOT SUPPORTED)
\g{-1}
backreference (NOT SUPPORTED)
\g{name}
named backreference (NOT SUPPORTED)
\g<name>
subroutine call (NOT SUPPORTED)
\g'name'
subroutine call (NOT SUPPORTED)
\k<name>
named backreference (NOT SUPPORTED)
\k'name'
named backreference (NOT SUPPORTED)
\lX
lowercase X (NOT SUPPORTED)
\ux
uppercase x (NOT SUPPORTED)
\L...\E
lowercase text ... (NOT SUPPORTED)
\K
reset beginning of $0 (NOT SUPPORTED)
\N{name}
named Unicode character (NOT SUPPORTED)
\R
line break (NOT SUPPORTED)
\U...\E
upper case text ... (NOT SUPPORTED)
\X
extended Unicode sequence (NOT SUPPORTED)
\%d123
decimal character 123 (NOT SUPPORTED) VIM
\%xFF
hex character FF (NOT SUPPORTED) VIM
\%o123
octal character 123 (NOT SUPPORTED) VIM
\%u1234
Unicode character 0x1234 (NOT SUPPORTED) VIM
\%U12345678
Unicode character 0x12345678 (NOT SUPPORTED) VIM
Character class elements
Example
Description
x
single character
A-Z
character range (inclusive)
\d
Perl character class
[:foo:]
ASCII character class foo
\p{Foo}
Unicode character class Foo
\pF
Unicode character class F (one-letter name)
Named character classes as character class elements
Example
Description
[\d]
digits (≡ \d)
[^\d]
not digits (≡ \D)
[\D]
not digits (≡ \D)
[^\D]
not not digits (≡ \d)
[[:name:]]
named ASCII class inside character class (≡ [:name:])
[^[:name:]]
named ASCII class inside negated character class (≡ [:^name:])
[\p{Name}]
named Unicode property inside character class (≡ \p{Name})
[^\p{Name}]
named Unicode property inside negated character class (≡ \P{Name})