All operations

Replace

Find text and swap it for something else.

What is loaded above

The pattern (\d+\.\d+\.\d+)\.\d+ matches a dotted quad and captures its first three octets. The replacement $1.x puts that capture back and drops the host part, which is how logs are usually anonymized to a subnet before anyone outside the team reads them. The three addresses in the sample come from 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, the ranges RFC 5737 reserves for documentation, so they point at nobody.

The pattern is loose enough to swallow 999.1.1.1 as well, which is what you want when tidying a log and useless when validating one.

Literal and pattern modes

Leave Treat as regular expression off and every metacharacter in the Find box is escaped before it is compiled, so a.c matches the three characters a.c and nothing else. Switch it on and the pattern compiles as typed. A pattern that will not compile stops the stage and names the fault, so a stray bracket surfaces as an error rather than silently passing the input through.

Replacement is always global. There is no first-match-only setting. Clearing Case sensitive adds the i flag and nothing else, so THE will also hit the middle of theme; supply your own \b boundaries when that matters.

The m and s flags are never set. ^ and $ anchor the whole input rather than each line, and . stops at a newline.

The replacement string

$1, $2 and so on insert numbered capture groups, $<name> inserts a named one, $& inserts the whole match, and $$ produces a literal dollar sign. Leaving the Replace with box empty deletes every match.

The replacement is never escaped, in either mode. Those tokens stay live even with the regular expression box unticked, so a literal search for admin replaced with [$&] still yields [admin]. Write $$1 to get the characters $1 out the other end.

In a chain

This is the stage that makes other stages work. A fingerprint with spaces in it will not go into the hex decoder until the spaces are gone, and a dump full of 0x prefixes has to lose them first. Cleanup that would otherwise mean editing the input by hand belongs here, where it stays visible and repeatable.

Case transform handles case-only rewrites without a pattern. Hexadecimal is usually the stage on the other side of that cleanup. Unicode normalize settles the accented forms first so one pattern matches all of them.