Spam Filter ISP Forums : Help with multiple RegEx search strings and using

Spam Filter ISP Forums : Help with multiple RegEx search strings and using https://www.logsat.com/spamfilter/forums/ Sun, 10 May 2026 07:50:31 +0000 Mon, 03 Jan 2005 17:56:00 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=4869 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Help with multiple RegEx search strings and using : Dan or Roberto, What RegEx would...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4930&title=help-with-multiple-regex-search-strings-and-using#4930 Author: CyberBob
Subject: 4869
Posted: 03 January 2005 at 5:56pm

Dan or Roberto,

What RegEx would you use to replace a comma in the fashion I'm trying to use it to "AND" two "expressions" or keywords together in an email?

I'd love to use (\s*) between each letter of mortgage but using the * will also block the actual word "mortgage."

So I need to combine a couple keywords like

approved,((m(\s*)o(\s*)r(\s*)t(\s*)g(\s*)a(\s*)g(\s*)e))

What would you use to replace the comma?

Thanks in advance,

Bob

]]> Mon, 03 Jan 2005 17:56:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4930&title=help-with-multiple-regex-search-strings-and-using#4930 <![CDATA[Help with multiple RegEx search strings and using : Ok guys thanks for the feedback...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4924&title=help-with-multiple-regex-search-strings-and-using#4924 Author: CyberBob
Subject: 4869
Posted: 03 January 2005 at 11:56am

Ok guys thanks for the feedback but through this process I've figured out how to make it work. I have multiple Regex rules separated by comma's including some plain words and it appears to be working and becoming one of my top rules in my "Top Keywords" report.

Let me monitor this for the next week or so and I'll report back as it appears to be a very powerful way to use RegEx multiple times in complicated rules.

Bob

]]> Mon, 03 Jan 2005 11:56:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4924&title=help-with-multiple-regex-search-strings-and-using#4924 <![CDATA[Help with multiple RegEx search strings and using : Bob,Dan is correct. Please see...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4922&title=help-with-multiple-regex-search-strings-and-using#4922 Author: LogSat
Subject: 4869
Posted: 02 January 2005 at 11:16pm

Bob,

Dan is correct. Please see http://www.logsat.com/spamfilter/forums/showmessage.asp?messageID=4921 for a confirmation.

Roberto F.LogSat Software]]> Sun, 02 Jan 2005 23:16:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4922&title=help-with-multiple-regex-search-strings-and-using#4922 <![CDATA[Help with multiple RegEx search strings and using : Dan,That was a good call, the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4921&title=help-with-multiple-regex-search-strings-and-using#4921 Author: LogSat
Subject: 4869
Posted: 02 January 2005 at 11:14pm

Dan,

That was a good call, the comma in a RegEx *will* be interpreted as a literal, it cannot be used to "and" two expressions. RegEx is as powerful as it is complicated, so we did that by design as with RegEx it should usually be possible to construct an expression such as to obtain what is required "and-ing" two or more expressions.

Roberto F.LogSat Software]]> Sun, 02 Jan 2005 23:14:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4921&title=help-with-multiple-regex-search-strings-and-using#4921 <![CDATA[Help with multiple RegEx search strings and using : Roberto, Can you give us some...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4915&title=help-with-multiple-regex-search-strings-and-using#4915 Author: CyberBob
Subject: 4869
Posted: 31 December 2004 at 11:36am

Roberto,

Can you give us some input here? I think Dan is saying the same this as me but clarify:

Is it ok to use comma's when seprating keywords EXCEPT when you use RegEx on both sides of the comma?

This is one of my top rules and obviously it's working well:

((?i)cheap|online,(d(\^|\s|-|\.*)r(\^|\s|-|\.*)u(\^|\s|-|\.*)g(\^|\s|-|\.*)s))

This rule first finds cheap or online THEN looks for any variation of the word "drug"

d r u g

d.r.u.g

d-r-u-g

or any variation

d.r u-g

But as soon as I try to add any RegEx to the "cheap or online" the rule stops working?

I'm still doing some testing and I think this will work but I'm not getting my escape brackets in the correct spot or enough/too many of them.

I'll post more as I find more but Roberto may have some better insight for us?

]]> Fri, 31 Dec 2004 11:36:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4915&title=help-with-multiple-regex-search-strings-and-using#4915 <![CDATA[Help with multiple RegEx search strings and using : I have been wrong before and I...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4898&title=help-with-multiple-regex-search-strings-and-using#4898 Author: Desperado
Subject: 4869
Posted: 29 December 2004 at 12:14pm

I have been wrong before and I hope Roberto will correct me if I mis-state this but ... *do not* use commas. They will be treated as literal commas and will not have the effect you think. Also, The SpamFilter implementation of RegEx can not "look ahead" so the "AND" function is not valid. What this means is that you can find 2 words in a message using a variety of ways to separate them but *only* in the order they are presented in the expression.

An additional issue is, if the expression is written to look for 2 words separated by too many characters, the expression may fail with a "Loop Stack Exceeded" error. Search your logs for "String Match" and you will locate any RegEx's that are failing. Often, however, a RegEx works in some cases but causes a "Loop Stack Exceeded" error in others. In fact, I just spent many hours "adjusting" 2 expressions that were causing that error way too often. I feel that it is probably a good idea to limit the "Search Scope" of an expression to avoid those errors as with the expression example below:

((?i)Subject:(([\s]|[\!-\xB4]){0,10}[\|]){2})

I would prefer to *not* use the "{0,10} clause but if I don't, I get many failures.

BTW, if anyone has a less complex way of doing the above RELIABLY, please chime in. This expression very simply catches any instance of 2 or more "Pipe" characters anywhere in the subject even if the pipes are separated by any of the first 115 ASCII characters.

Dan S.
]]> Wed, 29 Dec 2004 12:14:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4898&title=help-with-multiple-regex-search-strings-and-using#4898 <![CDATA[Help with multiple RegEx search strings and using : Now we are on the same wave length...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4897&title=help-with-multiple-regex-search-strings-and-using#4897 Author: CyberBob
Subject: 4869
Posted: 29 December 2004 at 11:44am

Now we are on the same wave length and I wonder if this is the problem. You use comma's to separate keywords you want the filter to find anywhere in the email body. This is a function of SpamFilter coding not RegEx.

So the Million dollar question :-) that I'm trying to get to:

Can you use two different RegEx rules on the same line AND separate them by comma's so the rule will find two keywords in an email?

Does this help?

]]> Wed, 29 Dec 2004 11:44:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4897&title=help-with-multiple-regex-search-strings-and-using#4897 <![CDATA[Help with multiple RegEx search strings and using : First, whats with the commas?...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4895&title=help-with-multiple-regex-search-strings-and-using#4895 Author: Desperado
Subject: 4869
Posted: 29 December 2004 at 11:31am

First, whats with the commas? I do not think you want any commas in your RegEx's

Let's start there and I will look at your expressions early this afternoon.

Dan

]]> Wed, 29 Dec 2004 11:31:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4895&title=help-with-multiple-regex-search-strings-and-using#4895 <![CDATA[Help with multiple RegEx search strings and using : Sorry for my rambling I think...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4893&title=help-with-multiple-regex-search-strings-and-using#4893 Author: CyberBob
Subject: 4869
Posted: 29 December 2004 at 11:07am

Sorry for my rambling I think I'm getting close to an answer but here's another way to say it.

Say we are going to block "online drugs" we add:

online,drugs

to the keyword list but we also need the variations using cheap drugs and online pharmacy so it now would read

cheap|online,drugs|pharmacy or we could use brackets

(cheap|online),(drugs|pharmacy) now if I wanted to look for upper/lower case

((?i)(cheap|online),(drugs|pharmacy))

At this point everything is ok but if we take to the next level and block anyone putting a space or hypen between letters then I start getting string errors. I'll just use one word to as an example so this doesn't get too long

((?i)(c(s|-*)h(s|-*)e(s|-*)a(s|-*)p|online),(drugs|pharmacy))

When I do this I start getting string errors in my log and I'm pretty sure I'm not using the proper amount of brackets in the correct places?

Once I start adding (s|-*) between the letters of "cheap" do I need another set of brackets to enclose the word and then another set to enclose "cheap|online" ????

So back to my original post I have found this to work well between letters

(s|-*) as it will look for zero or more of both space and hypen but you have to be careful with it, if you put this in your keywords by itself

c(s|-*)h(s|-*)e(s|-*)a(s|-*)p

it will not only block any variation of "c h e A p" or "c-h-e-a-p" but it will also block the plain word "cheap" and now you have people upset with you.

So I tried to use this rule with "|" and "," to put more keywords together and that's where my troubles started.

Sorry for the long post but I hope this makes more sense.

Thanks,

Bob

]]> Wed, 29 Dec 2004 11:07:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4893&title=help-with-multiple-regex-search-strings-and-using#4893 <![CDATA[Help with multiple RegEx search strings and using : Hmmm ... I am slightly confused....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4873&title=help-with-multiple-regex-search-strings-and-using#4873 Author: Desperado
Subject: 4869
Posted: 28 December 2004 at 11:30am

Hmmm ... I am slightly confused. EXACTLY what do you want blocked and *not* want blocked?

As an example: ((?i)((b.o.b))) Will block B O B and b-o b etc but not Bob.

Is this the sort of thing you are looking for?

WARNING ... this will also block baoab (not that that is a word!)

Dan S.

]]> Tue, 28 Dec 2004 11:30:00 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4869&PID=4873&title=help-with-multiple-regex-search-strings-and-using#4873