Note also that ^ and $ don't consume characters, and . doesn't match newlines without the /m flag. irb(main):009:0> "abc\ndef" =~ /^a.*^d/ => nil irb(main):010:0> "abc\ndef" =~ /^a.*^d/m => 0 irb(main):011:0> "abc\ndef" =~ /^a.*\r?\n^d/ => 0 re = %r{ (?#start: fetch the ip adress after IP) IP\s((?:\d+\.){3}\d{1,3}) (?#end: fetch ip) (?#start: flag).*:\s([PSF])(?#end:flag) (?#nothing more interesting on this line) .* (?#start: look for index pattern) ^E.{5}@.{8}Q.{30,} (?#end: index) (?#start: get the username which is surrounded by multiple dots, minimum of 2 in the begining and 0+ after) \.{2,}(\w+) (?#end: username) }xm src = "12:23:59.378678 IP 85.225.108.54.54707 > 81.227.132.223.6112: P 590518027:590518071(44) ack 2582330461 win 64240\nE..Te. / .t..U.l6Q.......#2....<]P.........,................wakko0.......... / ......" p re =~ src p $~.to_a -- Posted via http://www.ruby-forum.com/.