Regex Builder from Examples — Infer a Pattern from Positive + Negative Samples

Real-world use cases

• Pull SKU codes out of a messy export without writing the regex

  Your warehouse export has lines like `SKU-AX-00421-RED`, `SKU-AX-00422-BLU`, `SKU-BX-01193-BLK`. You need a regex to feed to a CLI parser. Paste those 3 lines as positives, paste `Total: 14 units` as a negative, hit Build. The first candidate comes back `SKU-[A-Z]{2}-\d{5}-[A-Z]{3}` — exact structure, rejects the total line, copy and paste into your pipeline. No counting digit positions by hand.

• Catch all version strings in a mixed log

  A log has `v1.2.3`, `v2.0.0`, `v10.4.21`, and you want a regex to extract them. Paste the three as positives. Paste `version 1` and `vNEXT` as negatives so the builder doesn't get sloppy. The tight candidate `v\d+\.\d+\.\d+` rejects both negatives and covers the variable-width major number — exactly what you wanted in under 10 seconds.

• Build a regex for a custom log line shape

  Your service emits `[2026-05-27 14:32:11] INFO user=alice action=login`. You have five of these from production. Paste them all as positives. The builder aligns the `[YYYY-MM-DD HH:MM:SS] LEVEL user=NAME action=VERB` skeleton, gives you the regex with named-ish capture groups for each variable field. Drop into Grafana / Loki query in 30 seconds.

• Validate a mixed Chinese-number field

  Your form receives values like `项目-001`, `项目-002`, `项目-127`, and someone occasionally types `Project-001` by mistake. Paste the Chinese ones as positives, the English one as a negative. The builder emits `项目-\d{3}` — locks the prefix to Chinese, rejects the English typo, your validation goes in.

• Infer a regex for multilingual filenames

  You're cleaning a download folder with names like `report_en.pdf`, `report_zh.pdf`, `report_ja.pdf`. Paste those as positives, paste `report.tmp` and `notes.pdf` as negatives. Candidate `report_[a-z]{2}\.pdf` comes back — 2-letter language code, .pdf extension, rejects both noise files. Bulk-rename script can now safely scan.

• Extract a single URL parameter across query strings

  You want to grab the `utm_source=X` value from request URLs like `?utm_source=newsletter&utm_medium=email`, `?utm_source=twitter&id=42`, `?other=foo&utm_source=hn_today`. Paste all three as positives, paste a URL without utm_source as a negative. The builder gives `utm_source=[\w_]+` — works regardless of parameter position.

Common pitfalls

• Heuristic, not exhaustive. The builder only sees the examples you paste — if production data has a shape that wasn't in your samples (e.g. an SKU with 4 digits not 5), the regex will miss it. Always test on a larger real corpus before relying on the output.

• We do NOT optimize the regex for runtime safety. Output is fine in JS / Go / Rust RE2, but feeding it into a naive backtracking engine (some PCRE configs, JS on adversarial input) can risk catastrophic backtracking. For untrusted text, prefer Go / Rust RE2.

• Pasting only 1-2 positives gives the aligner nothing to compare. The result collapses into `.+` or `\S+`. Paste at least 3-5 varied positives so the algorithm can tell "fixed char at this column" from "variable field starts here".

• Skipping negative examples produces over-permissive regexes. Negatives are where you tell the builder what to reject — 2-3 typos / near-misses are enough to eliminate the candidates that would accidentally accept wrong input.

• Mixing unrelated shapes in positives (`alice@example.com` + `+1-555-0100`) breaks the aligner. It only finds a skeleton if there is one. Group examples by shape; build one regex per group.

Privacy