How to Parse Log Lines with Regex in Python

Extracts timestamp, log level, service name, and message from a log line using compiled regex named groups.

Easy Python 3.9+ Aug 9, 2026 Observability & SRE 14 views 0 copies

regex logging parsing

Python code

19 lines

Python 3.9+

import re

LOG_PATTERN = re.compile(
    r'^(?P<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) '
    r'\[(?P<level>\w+)\] '
    r'\((?P<service>[^)]+)\) '
    r'(?P<message>.*)$'
)

def parse_log_line(line: str) -> dict:
    match = LOG_PATTERN.match(line)
    if not match:
        return {"error": "invalid log format"}
    return match.groupdict()

if __name__ == "__main__":
    mock_line = "2025-03-01 14:30:12 [INFO] (auth-service) User login successful"
    fields = parse_log_line(mock_line)
    print(fields)

Output

stdout

{'timestamp': '2025-03-01 14:30:12', 'level': 'INFO', 'service': 'auth-service', 'message': 'User login successful'}

How it works

The re.compile call precompiles the pattern for reuse, improving performance when parsing many lines. Named groups ((?P<name>...)) let match.groupdict() return a dict directly keyed by field name. The \w+ matches letters, digits, and underscores, covering typical log levels like INFO and ERROR. The [^)]+ captures any service name up to the closing parenthesis, which is why the pattern is robust to service names with spaces or dashes.

Common mistakes

Using `re.match` without anchoring the start (`^`) can still match a substring; always anchor when the line must start with the timestamp.
Forgetting to escape the backslashes in the pattern when building it as a raw string — use `r'...'` to keep `\d` as a digit class.
Assuming every log line matches the pattern; always handle the `None` case with a fallback dict like `{"error": "invalid log format"}`.

Variations

Use `re.search` instead of `re.match` if the timestamp may not appear at the start of the line.
Return a tuple like `(timestamp, level, service, message)` instead of a dict if you need faster positional access.

Real-world use cases

Parsing application logs in a SIEM or log aggregation pipeline to index structured fields for search.
Building a custom Python script that extracts service-level metrics from mixed-format log files.
Pre-processing logs before sending to a monitoring tool like Datadog or Prometheus for alerting.

How to Parse Log Lines with Regex in Python

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Observability & SRE

Tutorials

Quizzes

Python code

Output

How it works

Common mistakes

Variations

Real-world use cases

More from Observability & SRE

Keep learning

Tutorials

Quizzes