colortail.conf

COLOR magenta
{
# matches the date
^([A-Za-z]{3} [ 0-9][0-9])
}

COLOR cyan
{
# matches the time
^[A-Za-z]{3} [ 0-9][0-9] ([0-9]{2}:[0-9]{2}:[0-9]{2})
}

COLOR green
{
# matches the hostname
^[A-Za-z]{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2} ([^ ]+)
(done)
}

COLOR yellow
{
# matches the "program" that wrote to syslog
^[A-Za-z]{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2} [^ ]+ ([^ ]+:)
}

COLOR brightblue
{
^==> .* <==.*$
}

COLOR brightyellow
{
warning
# matches all ip adresses
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
# matches two ip adresses in one line
^.*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
^.*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*([0-9]{1}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*$
}

COLOR brightred
{
# matches the word root
^.*(root).*$
# matches DENY
^.*(ppp-in DENY ppp0).*$
^.*(eth-in DENY eth0).*$
No such file or directory
cannot
error
}

COLOR white
{
# matches the output from the "program"
^[A-Za-z]{3} [ 0-9][0-9] [0-9]{2}:[0-9]{2}:[0-9]{2}< [^ ]+ [^ ]+: (.*)
}