1;(GET|POST);;9957

2;HTTP\/1.[01];;10000
3;.+$;;10000
4;"(.*?)";;30000
5;(0[1-9]|[12][0-9]|3[01])/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/([0-9]
{4});;10000
6;:([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9];;10000
7;(%|\\x)[\d{2}|[A-Fa-f];;2765
8;\b(\d+(\.|:))+\d+\b;;65297
9;[1-5]\d{2}\s[1-9]\d*;;9331
10;HTTP/(0.9|1.[01]|2.0);;10000
11;^(\d{2,3});;9870
12;(?<=.*" )".*"$;;10000
13;(\+0000)+(?=]);;10000
14;(?<=:)([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9];;10000
15;(?<=.*] )"\p{L}.*?";;10000
16;GET(?! /favicon.ico);;9153
17;(?<!GET) /blog.*(?= HTTP);;17
18;(?<=\[(0[1-9]|[12][0-9]|3[01])/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|
Dec)/)\d{4}(?=.+\]);;10000
19;(?<=GET ).*(?= HTTP/\d.\d" (\d+|-) - );;627
20;^\d+\.\d+\.\d+\.\d+(?=.+Googlebot);;543
21;(?<!\d)([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(?!\d);;185858
22;^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[0-9][0-9]|[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-
9][0-9]|[0-9][0-9]|[0-9])){3};;4363
23;\[\d{2}.+\+\d{4}\];;10000
24;(?<=")((http|https)://.*?(?=/)|-(?="))(?!"$);;10000
25;(?<=" )\d+ (\d+|-)(?= ");;10000
26;(?<=^\d+\.\d+\.\d+\.\d+ )(\_(\p{Lu}|\p{Ll})|(\p{Lu}|\p{Ll}|-))|(?>=^.*? .*? )\
_(\p{Lu}|\p{Ll})|(\p{Lu}|\p{Ll}|-)(?= \[);;20000
**27;^\d+\.\d+\.\d+\.\d+(?=.+((:2[2-3]|0[0-5]):\d+:\d+|06:00:00:00));;2868
(3234)
28;^\d+\.\d+\.\d+\.\d+(?=.* "-" "-"$);;187
29;(?<="POST.*?" \d+ \d+ )".*?"(?= "\p{L}.*?");;2
30;"(GET|POST|PUT|DELETE|HEAD) /(\p{L}|\d|\.|-|_|~|%|\\x|!|\$|&|'|\(|\)|\*|\+|,|;|
=|/|:|@)*(\?(\p{L}|\d|\.|-|_|~|%|\\x|!|\$|&|'|\(|\)|\*|\+|,|;|=|/|:|@)*){0,2}
HTTP/(0\.9|1\.[01]|2\.0)";;9998
31;^(\d{1,3})\.(\d{1,3})\.\1\.\d{1,3};;30
32;\[(\d{1,2})/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/\1\d{2}.*?\];;2579
33;\[(\d{1,2})/(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/\1(\d{2}):\d{2}:\
d{2}:\3.*?\];;37
34; (^\d+\.\d+\.\d+\.\d+).*\n(\1.*\n){9};;12
35; .*] (".*?").*\n(.*] \1.*\n){2,};;15
36;"-"$;�Unknow�;190
37;(?<=".*?" 200 )-;0;213
38;^66.249.7(?=\d.\d{3}.*"GET /robots.txt HTTP/1.1");127.0.7;2
39;(.*)(?<= )/blog(.*)\n;;1959
40;.*\[(\d+/\p{L}+/\d+:\d+:\d+:\d+) \+\d+].*\n(.*\[\1 \+\d+].*\n){0,}(?=.*\[\1 \+\
d+].*\n);;3016

PRUEBAS:
26: (?<=^\d+\.\d+\.\d+\.\d+ | )((-|((\p{Lu}|\p{Ll}|\_)(\p{Lu}|\p{Ll}|\_|\d)
+))(?= )|(.*?)(?=\[))

La 27 nos sale diferente porque ellos oman las 6 horas completas, es decir, tambi�n
cuentan hasta las 6:59