The missing payment: finding text as it is

Your first morning. The director sets down her coffee cup and slides a sheet of paper across the desk. "The PC café owner came by yesterday. Customer says he paid $4.99, but there's no record. Logs don't lie. Go find it."

Here is the log. Today you hunt for evidence in these five lines.

2026-10-20 09:12:01 INFO  PAY user=kim  amount=$4.99  status=OK
2026-10-20 09:12:07 INFO  PAY user=lee  amount=$14.99 status=OK
2026-10-20 09:13:44 ERROR PAY user=park amount=$4.99  status=TIMEOUT
2026-10-20 09:15:02 INFO  PAY user=choi amount=$4999  status=OK
2026-10-20 09:16:30 ERROR DB  connection lost

1-1. A regex is a "text pattern" (5 min)

A regular expression (regex) is a tiny language for describing the shape of the text you want to find. In Python you use it through the re module. The simplest regex is just plain text: the pattern ERROR finds the text ERROR.

import re

log = "2026-10-20 09:13:44 ERROR PAY user=park"
m = re.search("ERROR", log)
print(m)          # <re.Match object; span=(20, 25), match='ERROR'>

• re.search(pattern, string) scans the string from the start and finds the first place where the pattern appears.
• If it finds one, it returns a Match object; if not, it returns None.

1-2. Did it match, and where? The Match object (5 min)

A Match object is proof that something was found, and also a report of what was found and where.

m = re.search("ERROR", log)
if m:                 # truthy if found, None is falsy
    print(m.group())  # ERROR       (the matched text)
    print(m.span())   # (20, 25)    (start position, end position)

• Test it directly for truth, as in if m:. When nothing is found you get None, and calling m.group() on it raises an AttributeError.
• The end position of span() is not included. It's the same rule that makes log[20:25] equal "ERROR".
• These exact values show up in the "First match" panel of the Evidence lab.

1-3. The 14 special characters (10 min)

Most characters simply find themselves. But the 14 below are metacharacters with a special meaning in a regex.

.  ^  $  *  +  ?  {  }  [  ]  \  |  (  )

Today you learn only the first one, .. The dot means any single character except a newline. The rest come out one lesson at a time.

re.search("a.c", "abc")    # match: b sits in the . spot
re.search("a.c", "a-c")    # match: - counts as any character too
re.search("a.c", "ac")     # None: . always takes up exactly one character
re.search("a.c", "a\nc")   # None: a newline is not a .

1-4. Switching off the special meaning with a backslash (10 min)

Back to the case. Say the five log lines above are stored in a string called pay_log. What happens if you look for the $4.99 payments by writing 4.99?

re.findall("4.99", pay_log)   # ['4.99', '4.99', '4.99', '4999']  ← four?

There should be two results, and there are four. The tail end of $14.99 got caught, and because . means "any character", the 4999 in $4999 slipped in too. To find a metacharacter as the literal character, put a backslash \ in front of it. \. is one real period.

$ is a metacharacter as well. You'll learn what it means in Lesson 4; for now, just remember that written bare, it does not look for a dollar sign. So the answer is \$4\.99.

re.findall(r"\$4\.99", pay_log)   # ['$4.99', '$4.99']

1-5. Why write r"...": raw strings (5 min)

Above, we put an r in front of the quotes, as in r"\$4\.99". This is called a raw string.

Backslashes are special in Python strings too: "\n" is a newline, "\t" is a tab. So if you write a regex as a normal string, Python interprets the backslashes first, and re receives a completely different pattern.

print(len("\b"))    # 1  ← Python turned \b into a single 'backspace' character
print(len(r"\b"))   # 2  ← a backslash and a b, two characters as written

• r"..." hands the backslashes to re untouched. Always write regexes as raw strings.
• Since Python 3.12, writing an escape Python doesn't know, such as "\d", in a normal string gives a SyntaxWarning. With a raw string there's no warning.

1-6. Finding exactly what a customer typed: re.escape (5 min)

The PC café owner adds, "The customer's ID is kim.99+. Can you find that too?" Write text like this directly as a pattern and the . and + are read as metacharacters. When you need to find text a person typed exactly as typed, re.escape puts a backslash in front of every metacharacter for you.

print(re.escape("kim.99+"))                        # kim\.99\+
re.search(re.escape("kim.99+"), "user=kim.99+")    # match

Cracking the case (10 min)

To sum up: the lines with an error are found with ERROR, and payments of exactly $4.99 are found with \$4\.99. Put the two conditions together and it comes out that customer park's payment was never recorded because of a TIMEOUT error.

for line in pay_log.splitlines():
    if re.search("ERROR", line) and re.search(r"\$4\.99", line):
        print(line)
# 2026-10-20 09:13:44 ERROR PAY user=park amount=$4.99  status=TIMEOUT

Exercises

1. Find every line in the log that says INFO. How many are there?
2. What does \$1.\.99 find? Make a guess before you check it in the lab.
3. Predict the result of re.escape("1+1=2? [yes]"), then run it yourself.