Technical Forum
Ask questions. Discover Answers.
Showing results for 
Search instead for 
Did you mean: 

Stumped by regular expression


Requirement: build a health Check to send an api url call to server and parse the return value for key indicators.




Crafted Send String: GET /rest/apigateway/health/all HTTP/1.1\r\nHost:\r\nConnection: Close\r\n\r\n


User name and password required: DEVF5Inside / <password>


Expected return to be parsed:



  "status": "green",

  "elasticsearch": {

    "cluster_name": "DEV_EventDataStore",

    "status": "green",

    "number_of_nodes": "2",

    "number_of_data_nodes": "2",

    "timed_out": "false",

    "active_shards": "388",

    "initializing_shards": "0",

    "unassigned_shards": "0",

    "task_max_waiting_in_queue_millis": "0",

    "port_9240": "ok",

    "response_time_ms": "16"


  "is": {

    "status": "green",

    "diskspace": {

      "status": "up",

      "free": "99419619328",

      "inuse": "152539549696",

      "threshold": "25195916902",

      "total": "251959169024"


    "memory": {

      "status": "up",

      "freemem": "2668806528",

      "maxmem": "3817865216",

      "threshold": "368102604",

      "totalmem": "3681026048"


    "servicethread": {

      "status": "up",

      "avail": "286",

      "inuse": "14",

      "max": "300",

      "threshold": "30"


    "response_time_ms": "103"


  "terracotta": {

    "status": "green",

    "nodes": "2",

    "healthy_nodes": "2",

    "response_time_ms": "67"




3 Key Indicators of healthy Services:



"elasticsearch": {

    "cluster_name": "DEV_EventDataStore",

    "status": "green",



"is": {

    "status": "green",



"terracotta": {

    "status": "green",



I would think it was possible to craft the received string parse to check for all 2 key indicators so I do not have to create 3 separate health checks.


I have tried just checking for the first indication by following suggestion in DevCentral but is did not work:


\"elasticsearch\": \{\"cluster_name\": \"DEV_EventDataStore\",\"status\": \"green\",


This solution is complicated by all 3 indicators being the same syntax: "status": "green"


I think there might be an issue with my GET string as well because the Monitor log only shows "200 OK" as the response from the server.


When I change the receive string to only elasticsearch, it passes.


Any Help Here?


F5 Employee
F5 Employee

I always start my regex development at


(\"elasticsearch\")(.*)(\n\B)(\s*.*\n\B)(\s*\"status\": \"green\")


matches the first stanza.


It gets harder from there ...

Could the issue actually be in the formatting of my GET string?


Here is the URL the DEV OPS Team gave me:



Here is how I formatted the Send String:

GET /rest/apigateway/health/all HTTP/1.1\r\nHost:\r\nConnection: Close\r\n\r\n


This request requires a username and password so they have been entered

Community Manager
Community Manager

Could you use an external monitor so you can parse the json return data more cleanly than with REGEX? in python, that would be pretty simple:

from sys import stdout
resp = '''your json response string'''
if resp['elasticsearch']['status'] == 'green' and resp['is']['status'] == 'green' and resp['terracotta']['status'] == 'green':

You can find a full python external monitor sample here in the codeshare for RADIUS that you could modify to meet your needs.


Issue resolved.


I discovered that the "Type" and "parent monitor" were set to "HTTPS" but SSL Profile was left at "NONE". I selected a generic ssl profile and the health check started functioning.


Here is what I end up with for the unique/per server in the pool/heath check.


Send String: GET /rest/apigateway/health/all HTTP/1.1\r\nHost:\r\nConnection: Close\r\n\r\n

Receive String: elasticsearch.*cluster_name.*DEV_EventDataStore.*status.*green.*number_of_nodes.*status.*green.*diskspace.*terracotta.*status.*green.*nodes


The additional items in the receive string parse are so the F5 does not match subsequent  "status": "green" occurrences in the reply.


Thank You for your responses.


I am moving forward with the "monitoring server platform" idea that will provide an UP/DOWN HTML page for the F5 to check.