# Bro regex documentation **URL:** \ **Category:** Zeek\ **Created:** [January 20, 2011, 7:37pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797 "2011-01-20T19:37:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sridhar\_basam1](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sridhar\_basam1](https://community.zeek.org/u/sridhar_basam1)\ **Post date:** [January 20, 2011, 7:37pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/1 "2011-01-20T19:37:53Z")
Can anyone point me at documentation on Bro’s builtin string/pattern functions? The reference manual on the wiki points me at strings.bif.bro which doesn’t have a lot of documentation around it. Does bro support back-references? I am trying to look for specific patterns in a tcp stream and need to be able to log out said patterns to a file. thanks, Sridhar ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 20, 2011, 8:23pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/2 "2011-01-20T20:23:59Z")
> Can anyone point me at documentation on Bro's builtin string/pattern functions? The regular expressions are most similar to flex's regular expressions (with minor differences), but you can typically assume that they are POSIX regular expressions. > Does bro support back-references? No. I'll let Robin or Vern give more detail here if they want to, I'm definitely not qualified to explain all of the reasons that back references aren't supported. 🙂 > I am trying to look for specific patterns in a tcp stream and need to be able to log out said patterns to a file. Why don't the string splitting functions (defined in strings.bif) work for your scenario?   .Seth ---
**Author:** ![sridhar\_basam1](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sridhar\_basam1](https://community.zeek.org/u/sridhar_basam1)\ **Post date:** [January 21, 2011, 3:04pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/3 "2011-01-21T15:04:17Z")
Yeah, those can be used together to see what i want. Wanted to see if there was something similar to the match function in gawk where the function returns an array of all of the variables you collect in your pattern. I didn’t see anything like it. Sridhar ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [January 21, 2011, 3:20pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/4 "2011-01-21T15:20:20Z")
The match function in gawk only seem to return the position of the beginning of the match? I this the split\_all function should work for what you are trying to do. Here's a note from the source code... # For example, split\_all("a-b--cd", /(\-)+/) returns {"a", "-", "b", # "--", "cd"}: odd-indexed elements do not match the pattern # and even-indexed ones do. split\_all will give you all of the things matching the split regex and the bits between the split regex. You can just look into the string\_array for odd numbers indexes if you want what didn't match as a separator and even if you want what did match.   .Seth ---
**Author:** ![sridhar\_basam1](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sridhar\_basam1](https://community.zeek.org/u/sridhar_basam1)\ **Post date:** [January 21, 2011, 3:34pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/5 "2011-01-21T15:34:36Z")
The match function will also return substrings from your regex pattern and return it in an array if you provide the optional 3rd parameter. So if you do match(input, /a=(.+) b=(.+) c=(.+)/, ret), you will get the values you want in the array ret. I think with what you pointed out for split functions i should be able to get what i need though. thanks, Sridhar ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [January 21, 2011, 5:47pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/6 "2011-01-21T17:47:37Z")
The quick answer here is that Bro matches regexps with DFAs. While DFAs are very efficient, they can't do backreferences. Robin ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-regex-documentation/1797/7 "2022-05-06T15:39:25Z")