Product Documentation

Regular Expressions

Sep 02, 2013

When you want to perform string matching operations that are more complex than the operations that you perform with the CONTAINS(“<string>”) or EQ(“<string>“) operators, you use regular expressions. The policy infrastructure on the Citrix® NetScaler® appliance includes operators to which you can pass regular expressions as arguments for text matching. The names of the operators that work with regular expressions include the string REGEX. The regular expressions that you pass as arguments must conform to the regular expression syntax that is described in "" You can learn more about regular expressions at "" and at ""

The target text for an operator that works with regular expressions can be either text or the value of an HTTP header. Following is the format of a default syntax expression that uses a regular expression operator to operate on text:


The string <text> represents the default syntax expression prefix that identifies a text string in a packet (for example, HTTP.REQ.URL). The string <regex_operator> represents the regular expression operator. The regular expression always begins with the string re. A pair of matching delimiters, represented by <delimiter>, enclose the string <regex_pattern>, which represents the regular expression.

The following example expression checks whether the URL in an HTTP packet contains the string *.jpeg (where * is a wildcard) and returns a Boolean TRUE or FALSE to indicate the result. The regular expression is enclosed within a pair of slash marks (/), which act as delimiters.


Regular expression operators can be combined to define or refine the scope of a search. For example, <text>.AFTER_REGEX(re/regex_pattern1/).BEFORE_REGEX(re/regex_pattern2/) specifies that the target for string matching is the text between the patterns regex_pattern1 and regex_pattern2. You can use a text operator on the scope that is defined by the regular expression operators. For example, you can use the CONTAINS(“<string>”) operator to check whether the defined scope contains the string abc:


Note: The process of evaluating a regular expression inherently takes more time than that for an operator such as CONTAINS(“<string>”) or EQ(“<string>”), which work with simple string arguments. You should use regular expressions only if your requirement is beyond the scope of other operators.