rules:
- description: IPv4
  regex: \b(?<!\.)((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d)(/\d+)?(?!\.)\b
  color: f#00ffff

- description: IPv6 (boundaries don't work here as they can be in the start or end of the match, so using lookaheads and lookbehinds instead)
  regex: (?i)((?<=[\W])|^)(?<!:)(([\da-f]{1,4}:){7}[\da-f]{1,4}|([\da-f]{1,4}:){1,1}(:[\da-f]{1,4}){1,6}|([\da-f]{1,4}:){1,2}(:[\da-f]{1,4}){1,5}|([\da-f]{1,4}:){1,3}(:[\da-f]{1,4}){1,4}|([\da-f]{1,4}:){1,4}(:[\da-f]{1,4}){1,3}|([\da-f]{1,4}:){1,5}(:[\da-f]{1,4}){1,2}|([\da-f]{1,4}:){1,6}(:[\da-f]{1,4})|([\da-f]{1,4}:){1,7}:|:((:[\da-f]{1,4}){1,7}|:)|::(ffff(:0{1,4})?:)?((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d)|([\da-f]{1,4}:){1,4}:((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d))(%[\da-z]+)?(/\d+)?(?!:)((?=[\W])|$)
  color: f#ff00c0

- description: MAC addresses
  regex: (?i)\b((?<!:)([\da-f]{1,2}:){5}[\da-f]{1,2}(?!:)|(?<!\.)([\da-f]{4}\.){2}[\da-f]{4}(?!\.))\b
  color: f#ff9aff

- description: Date in YYYY-MM-DD, YY-MM-DD, MMM (YYYY|DD), or DD MMM (YYYY)? formats
  regex: (?i)((?<=[\W])|^)((\d{2}|\d{4})\-((0)?[1-9]|1[0-2])\-(3[0-1]|([1-2]\d)|(0)?[1-9])|(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s(\d{4}|\s\d|(3[0-1]|([0-2]\d)))|((\d|(3[0-1]|([0-2]\d)))\s(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)(\s\d{4})?))((?=[\WT_])|$)
  color: f#ffff80

- description: Time in hh:mm:ss.SSSSSS format (sec, msec, and nsec optional)
  regex: \b((?<!:)((2[0-3])|[0-1]\d|[0-9]):[0-5]\d(:[0-5]\d)?((\.|,)\d{3,6})?(?!:))\b
  color: f#ffff80
  
- description:  Juniper Interfaces
  regex: (?i)\b(((fe|ge|xe|et|gr|ip|lt|lsq|mt|sp|vcp)\-\d*/\d*/\d*)|(((b)?me|em|fab|fxp|fti|lo|pp(d|e)?|st|swfab)[0-2]|dsc|gre|ipip|irb|jsrv|lsi|mtun|pimd|pime|tap|vlan|vme|vtep)|((ae|reth)\d*))(\.\d*)?\b
  color: f#0099ff
  
- description: Cisco Interfaces
  regex: (?i)\b(((Hu(ndredGigabit)?|Fo(rtyGigabit)?|Te(nGigabit)?|Gi(gabit)?|Fa(st)?)(Ethernet)?)|Eth|Se(rial)?|Lo(opback)?|Tu(nnel)?|VL(AN)?|Po(rt-channel)?|Vi(rtual\-(Template|Access))?|Mu(ltilink)?|Di(aler)?|(B|N)VI)((\d*/){0,2}\d*)(\.\d*)?\b
  color: f#0099ff

- description: Generics - Bad
  regex: (?i)\b(password|abnormal(ly)?|down|los(t|s|ing)|err(or(s)?)?|(den(y|ies|ied)?)|reject(ing|ed)?|drop(ped|s)?|(err\-)?disable(d)?|(time(d)?(\-)?out)|fail(s|ed|iure)?|disconnect(ed)?|unreachable|invalid|bad|notconnect|unusable|block(ing|ed)?|blk|inaccessible|wrong|collision(s)?|unsynchronized|mismatch|runts|CRC|resets)\b
  color: f#ff0000

- description: Generics - Ambigious bad
  regex: (?i)\b(no(t|pe)?|exit(ed)?|reset((t)?ing)?|discard(ed|ing)?|filter(ed)?|stop(p(ed|ing))?|never|can((')?t|not))\b
  color: f#ff4d4d

- description: Generics - Not too bad
  regex: (?i)\b(warning(s)?)\b
  color: f#ffff00

- description: Generics - Ambigious good
  regex: (?i)\b(ye(s|a(h)?|p)?|started|running|can)\b
  color: f#14eb1c

- description: Generics - Good
  regex: (?i)\b(up|ok(ay)?|permit(ed|s)?|accept(s|ed)?|enable(d)?|online|succe((ss(ful|fully)?)|ed(ed)?)?|connect(ed)?|reachable|valid|forwarding|synchronized)\b
  color: f#00ff00

- description: User highlight root
  regex: root
  color: f#ff0000 bold
  
- description: User highlight cdassy and k0588492
  regex: cdassy|k0588492
  color: f#00bfff bold
    
- description: User highlight
  regex: ^([^$#(]+)(\$|#|\([^)]+\)#)
  color: f#ffffff bold

- description: User highlight Juniper
  regex: (^\w+)(@)(.*>)
  color: 
    1: f#00bfff bold
    2: f#00ffc0 bold
    3: f#ffffff bold
    
- description: User highlight Juniper Root
  regex: (^\w+)(@)(.*%)
  color: 
    1: f#ff0000 bold
    2: f#00ffc0 bold
    3: f#ffffff bold
    
- description: User highlight Ubuntu
  regex: (^\w+)(@)(.*\$)
  color:
    1: f#00bfff bold
    2: f#00ffc0 bold
    3: f#ffffff bold
    
- description: User highlight Ubuntu Root
  regex: (^\w+)(@)(.*(#))
  color:
    1: f#ff0000 bold
    2: f#00ffc0 bold
    3: f#ffffff bold
    4: f#00bfff bold

- description: Interfaces Speed Cisco
  regex: "^  [0-9]{1,2} [a-z]{6} [a-z]{5,6} rate ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})([0-9]{3}) bits.*$"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2
    5: f#bfff00

- description: Interfaces Speed Cisco
  regex: "^  [0-9]{1,2} [a-z]{6} [a-z]{5,6} rate ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3}) bits.*$"
  color:    
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2

- description: Interfaces Speed Cisco
  regex: "^  [0-9]{1,2} [a-z]{6} [a-z]{5,6} rate ([0-9]{1,3})([0-9]{3})([0-9]{3}) bits.*$"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000

- description: Interfaces Speed Cisco
  regex: "^  [0-9]{1,2} [a-z]{6} [a-z]{5,6} rate ([0-9]{1,3})([0-9]{3}) bits.*$"
  color:
    1: f#00ffc0
    2: f#00bfff

- description: Interfaces Speed Cisco
  regex: "^  [0-9]{1,2} [a-z]{6} [a-z]{5,6} rate ([0-9]{1,3}) bits.*$"
  color:
    1: f#00ffc0

- description: Big Number
  regex: " ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})([0-9]{3}) "
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2
    5: f#bfff00

- description: Big Number
  regex: " ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3}) "
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2
    
- description: Big Number
  regex: " ([0-9]{1,3})([0-9]{3})([0-9]{3}) "
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000

- description: Interfaces Speed Juniper
  regex: "(?=.*Input).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2
    5: f#bfff00
    
- description: Interfaces Speed Juniper
  regex: "(?=.*Input).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2

- description: Interfaces Speed Juniper
  regex: "(?=.*Input).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000

- description: Interfaces Speed Juniper
  regex: "(?=.*Input).{1,} ([0-9]{1,3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff

- description: Interfaces Speed Juniper
  regex: "(?=.*Input).{1,} ([0-9]{1,3})"
  color:
    1: f#00ffc0
    
- description: Interfaces Speed Juniper
  regex: "(?=.*Output).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2
    5: f#bfff00
    
- description: Interfaces Speed Juniper
  regex: "(?=.*Output).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000
    4: f#ff4dd2

- description: Interfaces Speed Juniper
  regex: "(?=.*Output).{1,} ([0-9]{1,3})([0-9]{3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff
    3: f#ffc000

- description: Interfaces Speed Juniper
  regex: "(?=.*Output).{1,} ([0-9]{1,3})([0-9]{3})"
  color:
    1: f#00ffc0
    2: f#00bfff

- description: Interfaces Speed Juniper
  regex: "(?=.*Output).{1,} ([0-9]{1,3})"
  color:
    1: f#00ffc0
    
- description: Route installed timelength
  regex: (?i)(\b[0-9]{1,4}w[0-9]d\b)|(\b[0-9]d[0-9]{1,2}h\b)|(\b[0-9]{1,4}w[0-9]d[0-9]{1,2}h\b)|(\b[0-9]d\s\b)|(\b(\d{3,4}d\d{2}h)\b)
  color: f#ffc080
  
- description: Routing table metrics
  regex: (\[\d{1,3}\/\d{1,12}\])
  color: f#fff000
    
- description: Half-duplex
  regex: (?i)\b(half(\-)?duplex)\b|\b(half|a-half)\b
  color: b#ff0000 f#ffffff
  
- description: Full-duplex
  regex: (?i)\b(full(\-)?duplex)\b|\b(full|a-full)\b
  color: f#0099ff

- description: Spanning tree - Problematic states
  regex: \b(BKN|(LOOP|ROOT|TYPE|PVID)_Inc)\b
  color: f#ff0000

- description: Spanning tree - Forwarding states
  regex: \b(FWD|Root|Desg|DESG)\b
  color: f#00ccff

- description: OSPF - Transitional states
  regex: \b(ATTEMPT|INIT|EXCHANGE|LOADING)\b
  color: f#ffff00

- description: OSPF - Acceptable states
  regex: \b(2WAY|FULL)\b
  color: f#00ff00
  
- description: OSPFv2 and OSPFv3
  regex: \b(OSPF_VL\d{1,2}|OSPF_SL\d{1,2}|VL\d{1,2}|SL\d{1,2}|Type\-\d|ospf|OSPF|O|IA|E[12]|N[12]|P2P|P2MP|BDR|DR|ABR|ASBR|LOOP|DROTHER|POINT_TO_POINT|POINT_TO_MULTIPOINT|BROADCAST|NON_BROADCAST|LOOPBACK|SHAM_LINK|3101|1587|transit|Transit|nssa|NSSA|stub|Stub|Superbackbone|OSPFv3_VL\d{1,2}|OSPFv3\-\d{1,5}\-IPv6|ospfv3|OSPFv3|OI|OE[12]|ON[12]|V6\-Bit|E\-Bit|R\-bit|DC\-Bit|opaque|DROTH|%OSPF(V3)?\-\d\-\w+)\b
  color: f#ffa500

- description: BGP - Transitional states
  regex: \b(Idle|Connect|Active|OpenSent|OpenConfirm)\b
  color: f#ff4f00 bold
  
- description: BGP
  regex: \b((Cost:pre\-bestpath|0x880\d):\d{1,10}:\d{1,10})\b
  color: f#dadada

- description: BGP Part 2
  regex: \b(%(BGP|BGP_SESSION)\-\d\-\w+|bgp|BGP|B|IGP|incomplete|\d{2,7}\/nolabel\(\w+\)|RR\-client|Originator|cluster\-id|Cluster\-id|Cluster|Route\-Reflector)\b
  color: f#4da6ff
  
- description: RIP
  regex: \b((rip|RIP|R))\b
  color: f#ff0000
  
- description: EIGRP
  regex: \b(EIGRP\-IPv6|EIGRP\-IPv4|eigrp|EIGRP|EX|D|K[13]=1|K[245]=0|Internal|External|%DUAL\-\d\-\w+)\b
  color: f#00e7e7
  
- description: EIGRP topology table metrics and ping responses
  regex: \b(\(\d{1,12}\/\d{1,12}\))
  color: f#ffff00
  
- description: VPNv4 Addresses
  regex: \b((\d{1,10}:){2}((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d)|((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d):\d{1,10}:((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d))\b
  color: f#00ffff

- description: VPNv6 Addresses
  regex: (?i)\[(\d{1,10}|\d{1,3}(\.\d{1,3}){3}):\d{1,10}\](([\da-f]{1,4}:){7}[\da-f]{1,4}|([\da-f]{1,4}:){1,1}(:[\da-f]{1,4}){1,6}|([\da-f]{1,4}:){1,2}(:[\da-f]{1,4}){1,5}|([\da-f]{1,4}:){1,3}(:[\da-f]{1,4}){1,4}|([\da-f]{1,4}:){1,4}(:[\da-f]{1,4}){1,3}|([\da-f]{1,4}:){1,5}(:[\da-f]{1,4}){1,2}|([\da-f]{1,4}:){1,6}(:[\da-f]{1,4})|([\da-f]{1,4}:){1,7}:|:((:[\da-f]{1,4}){1,7}|:)|::(ffff(:0{1,4})?:)?((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d)|([\da-f]{1,4}:){1,4}:((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d))(?![:.\w])
  color: f#00ffff  
  
- description: IP-address:nn RD or RT
  regex: \b(RT:)?((25[0-5]|(2[0-4]|[0-1]?\d)?\d)\.){3}(25[0-5]|(2[0-4]|[0-1]?\d)?\d):(?:[1-9]|\d{2,5})\b
  color: f#00ffff

- description: Syslog facilities - Emergency to error
  regex: \b(%\w+\-[0-3]\-\w+)\b
  color: f#ff3333

- description: Syslog facilities - Warning to notice
  regex: \b(%\w+\-[4-5]\-\w+)\b
  color: f#ffff00

- description: Syslog facilities - Info to debug
  regex: \b(%\w+\-[6-7]\-\w+)\b
  color: f#65d7fd

- description: Bad responses
  regex: \b(administratively|down|Down|DOWN|fail|failed|not|not active|not activated|bad|never|BLK|fddi|n\-isl|isl|notconnect|blocking|\(tdp\)|tdp|TDP|denied|invalid|err\-disabled|disabled|unusable|DENIED|err\-disable|infinity|inaccessible|wrong|cannot|MM_NO_STATE|MM_KEY_EXCH|UP\-NO\-IKE|K[13]=(\d{2,3}|[02-9])|K[245]=(\d{2,3}|[1-9]))\b
  color: f#ff0000

- description: Good responses
  regex: \b(rstp|RSTP|best|our_master|UP\-ACTIVE|\*\>|Root|802\.1q|connected|LocalT|yes|forwarding|synchronized|active|rapid\-pvst|up|Up|UP)\b
  color: f#00ff00

- description: Possible warning and other things that deserve attention
  regex: '(?<!\w)(Total output drops: [1-9][0-9]*|[1-9][0-9]* ((input |output )?errors|runts|CRC|(late )?collisions|unknown protocol drops)|act\/unsup|dhcp|DHCP|LRN|learning|listening|LIS|unsynchronized|Peer\(STP\)|Shr|Edge|pvst|ieee|Bound\(PVST\)|TFTP|Mbgp|LAPB|l2ckt\(\d{1,10}\)|DCE|DTE|passive|r |RIB\-failure|discriminator|Standby|aggregate(d|\/\w+)|atomic\-aggregate|\(global\)|tag|key-chain|md5|backup\/repair|repair|v2\/D|v2\/SD|Condition\-map|Advertise\-map|no\-advertise|no\-export|local\-AS|internet)(?!\w)'
  color: f#ffff00

- description: Multicast
  regex: \b((PIM\/IPv4|RP\:|v2\/S|BSR)|%(PIM|MSDP|IGMP)\-\d\-\w+)\b
  color: f#ff00ff

- description: LDP
  regex: \b(%(LDP|LSD)\-\d\-\w+)\b
  color: f#ff00ff

- description: IPv6 Neighbor Discovery
  regex: \b(%IPV6_ND\-\d\-\w+)\b
  color: f#00ffff
 
- description: Juniper show | compare +
  regex: "^\\+ (.*)$"
  color: f#00dc1a
  
- description: Juniper show | compare -
  regex: "^\\- (.*)$"
  color: f#ff3333