Python Parse Log Lines with Named Groups

Give regex capture groups names that express each log field.

How It Works

Named groups make record parsing less fragile than relying on numbered positions. A match can be converted into a dictionary with groupdict(), after which the captured strings need normal type conversion and validation. Patterns should fail visibly on unexpected log formats.

Regex is appropriate for known log formats; a structured logging format reduces parsing ambiguity.

Step-by-Step Example

import re

line = "2026-10-17 INFO Backup completed"
pattern = re.compile(r"(?P<date>\d{4}-\d{2}-\d{2}) (?P<level>INFO|WARN|ERROR) (?P<message>.+)")
match = pattern.fullmatch(line)
if match is None:
    raise ValueError("Unexpected log format")
print(match.groupdict())

Understanding the Example

The expression '"2026-10-17 INFO Backup completed"' supplies the value stored as 'line'. This value is then used or checked by the later statements.
The expression 're.compile(r"(?P<date>\\d{4}-\\d{2}-\\d{2}) (?P<level>INFO|WARN|ERROR) (?P<message>.+)")' supplies the value stored as 'pattern'. This value is then used or checked by the later statements.

A successful run of this example prints the following output:

{'date': '2026-10-17', 'level': 'INFO', 'message': 'Backup completed'}

Where This Fits in a Real Program

Start by writing down examples that should match and examples that must fail. Check whether you need to locate a substring, match a prefix or validate an entire field; these are different operations. Unicode and escape sequences can also change which characters are matched, so test accented text and empty input.

Practice: Try It Yourself

Add an ERROR log entry and convert the date field with date.fromisoformat().

For this exercise, predict the result before running the changed code. Then explain the difference between the original and modified cases using the actual values, not just whether the program completed.

Common Beginner Mistakes

Assuming a matched date-like string must be a real calendar date without parsing it.
Indexing named groups before checking whether match returned None.

Key Takeaways

Give regex capture groups names that express each log field.
Named groups make record parsing less fragile than relying on numbered positions.
Regex is appropriate for known log formats; a structured logging format reduces parsing ambiguity.