Search Modes

The search panel has four search modes. Literal text is the default. The .*, 0x, and Str buttons switch to the other modes, and only one of them can be on at a time. For the panel itself, see Searching a file.

How Vaste matches

Vaste searches the bytes of the file in the file’s own encoding, the encoding shown in the status bar. A match belongs to the line where it starts, even if it continues onto the next line.

Literal text

With no mode button on, Vaste finds the text exactly as you typed it. Vaste converts the pattern to the file’s encoding first, so literal search works in UTF-16 files and in files with a legacy encoding such as windows-1252. If the pattern contains a character the encoding cannot represent, the search stops with the error Cannot encode pattern ‘…’ to file encoding.

• Aa ignores case for the ASCII letters A to Z only. Accented and other non-ASCII letters still match case.
• W matches only where the pattern is not joined to a letter, digit, or underscore on either side. Only ASCII letters and digits count as word characters.

Several literal patterns

With Multi on, Vaste reads the search box as several literal patterns separated by |, for example ERROR | WARN | timeout. Spaces around a bar are ignored, and an empty part is skipped. Vaste finds every place where any of the patterns occurs, in one pass over the file. Two patterns do not overlap: in abcd, the patterns ab and bc give one match.

• Aa applies to every pattern, for the ASCII letters A to Z.
• W has no effect in this mode and is hidden.
• A bar cannot be part of a pattern in this mode. To search for text that contains |, turn Multi off.

A saved filter made in this mode keeps the patterns, and a tail alert made from it fires on any of them.

Regular expressions

Select .* to read the pattern as a regular expression. The syntax is that of the Rust regex crate, with Unicode support turned off. This changes some familiar rules:

Pattern	Meaning in Vaste
^ and $	The start and end of the whole file, not of each line
(?m)^ and (?m)$	The start and end of each line
.	Any byte except a newline
\w, \d, \s	ASCII word characters, digits, and whitespace only
\b	A boundary between an ASCII word character and anything else
\p{…}	Not supported. The search stops with an error.

Tip

To find lines that start with a word, add (?m) at the start of the pattern: (?m)^ERROR finds ERROR at the start of any line. Without (?m), ^ERROR matches only if the file itself starts with ERROR.

In a file with Windows line endings (CRLF), each line ends with a carriage return before the newline, and (?m)$ matches after it. To match the end of such a line, allow the carriage return: (?m)done\r?$ finds done at the end of a line in both kinds of file. The status bar shows the file’s line endings.

A few examples:

• (?m)^\d{4}-\d{2}-\d{2}: a date at the start of a line.
• timeout after \d+ ms: the text with any number in it.
• (?i)error|fatal: either word, in any case. Aa has the same effect as (?i).
• user=(\w+): a user name, captured as group 1. See Capture groups.

The other options work with regular expressions:

• Aa ignores case for ASCII letters only.
• W wraps the pattern in \b(?:…)\b, so the whole match must be a whole word. Your group numbers do not change.

Keep these rules in mind:

• A pattern with non-ASCII characters, such as é, matches them as UTF-8 bytes. It does not find them in a file with a legacy single-byte encoding such as windows-1252. Use literal text for those files.
• A match of zero length, such as the pattern ^ alone, is not reported.
• Regular expressions do not work in UTF-16 files. The search stops with the message Regex search is not supported for UTF-16 encoded files. Use literal text instead.
• If the pattern is not valid, the search stops with Invalid regex: followed by the reason.

Hex byte patterns

Select 0x to search for a sequence of bytes. Type the bytes as pairs of hexadecimal digits, with or without spaces: FF D8 FF E0 and ffd8ffe0 find the same bytes. Letter case does not matter. There are no wildcards, so every byte in the pattern must match exactly.

If the pattern holds anything other than pairs of hexadecimal digits and spaces, such as an odd number of digits, a 0x prefix, or commas, the search stops with Invalid hex pattern.

The results list shows each match as a byte offset, for example 0x0001F400. Selecting a match, or pressing F3 or Shift + F3, shows it in Hex view and moves the byte cursor to it; from Text view this switches to Hex view. Running the search does not switch views on its own. See Hex view.

Printable strings

Select Str, or press Alt + S (Find strings) in Hex view, to list the runs of printable text in a file, like the strings command. A run is a sequence of printable ASCII characters and tabs that is at least as long as the minimum length you set next to the search box: 2 to 256 characters, 4 by default. Select 16 to also find text stored as UTF-16LE.

With Str on, the search box is optional. Leave it empty to list every run, or type text to list only the runs that contain it. Aa applies to that text.

Use a strings search to find readable text, such as messages and paths, inside a binary file. For the details, see Hex analysis tools.

Next steps

• Working with results: the results list, capture groups, copy, and export
• Combining searches: find lines that match one pattern and not another