A while back I asked if anyone had a REGEXP to deal with IIS log files. Well, It was more complex than that. It seems that the logfiles are mangled by the MSFT log parser tool into a very weird format.

And here is the REGEXP I had to use.

/^(S+) (d+) (d+-d+-d+) (d+:d+:d+) (S+) (-) (S+) (S+) (S+) (d+) (S+) (.+?) (.+?) (S+) (S+) (-) (S+) (S+) (S+) (S+) (S+) (S+) (.+?) (.*)$/

Nice, isn’t it?