# Query regarding pattern match

**URL:** https://community.zeek.org/t/query-regarding-pattern-match/3291
**Category:** Zeek
**Created:** [September 28, 2014, 9:43am UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291 "2014-09-28T09:43:09Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Balasubramaniam\_Nata](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@Balasubramaniam\_Nata](https://community.zeek.org/u/Balasubramaniam_Nata)
#### Post date: [September 28, 2014, 9:43am UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291/1 "2014-09-28T09:43:09Z")

</div>

Hi

Could someone explain to me as to why would the pattern match of [:digit:] match characters and print s2 in the link given below ?

[http://try.bro.org/#/trybro/saved/d1c1dbb4-0148-4097-8967-0a5d2e796d69](http://try.bro.org/#/trybro/saved/d1c1dbb4-0148-4097-8967-0a5d2e796d69)

Just in case the above link changes as I work on new exercise I have uploaded a screenshot as well.

![](http://imagizer.imageshack.com/img537/786/NKWnng.png)

---

<div class="post-metadata">

### Author: ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [September 28, 2014, 12:15pm UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291/2 "2014-09-28T12:15:57Z")

</div>

Hello,

Bro regular expressions does not support this kind of character classes. As far as I know it only supports listing all letters you want to include, negation or ranges. The line matches because the letter t is included in :digit: as well as s2.

Johanna

---

<div class="post-metadata">

### Author: ![Balasubramaniam\_Nata](https://avatars.discourse-cdn.com/v4/letter/b/5e9695/32.png) [@Balasubramaniam\_Nata](https://community.zeek.org/u/Balasubramaniam_Nata)
#### Post date: [September 28, 2014, 2:46pm UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291/3 "2014-09-28T14:46:16Z")

</div>

Thanks for explaining.

I got a bit confused by the Subexercise Part 2 example on the link [https://www.bro.org/current/exercises/prog-primer/part1.bro](https://www.bro.org/current/exercises/prog-primer/part1.bro) Now I understand that we cannot use such character classes.

---

<div class="post-metadata">

### Author: ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)
#### Post date: [September 28, 2014, 2:49pm UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291/4 "2014-09-28T14:49:25Z")

</div>

Actually I was wrong - the example you cited explains it correctly. You need to use double parentheses with the character classes - if you use [[:digit:]] it works perfectly.

Johanna

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/query-regarding-pattern-match/3291/5 "2022-05-06T15:42:06Z")

</div>


