Inverse regex filtering with varnishtop

I was curious which user agents were accessing a side project of mine, but I wanted to exclude user agents that contained the string “Mozilla.” Luckily, Varnish includes a tool called varnishtop which is exactly designed for this sort of question.

To view all user agents, the command would be: # varnishtop -C -I ReqHeader:User-Agent. Pretty simple and actually taken directly from the man page.

My hope was then that something like # varnishtop -C -I ReqHeader:User-Agent -X Mozilla would include all request headers that contained User-Agent and then exclude any that contained “Mozilla” but this didn’t work. Basically, each -I and -X option is “OR’d” together, not “AND’d” together.

After picking up some tips from StackOverflow, I figured out the syntax that I needed. Basically, I had to negate directly within the include (-I) option: # varnishtop -C -I 'ReqHeader:User-Agent: (?!Mozilla)'.