Analyzing a web access log to obtaining totals for requests
If you don't need fields other than size, and have no use for lines with no size, a simpler regex like \s(\d+)$ is going to be appreciably faster.  You could even go with \s(\d{4,})$ and skip the &gt;= 1000 test.  

If you do keep the full regex, I'd simplify the date portion because date formats are notoriously unpredictable.  \[[^]]+\] does the job more robustly. 

(\S+)? is better written as (\S*).

filename_regex is better named  like log_entry_regex, since that's what it matches.

Overwriting the string line with an array of captures is ugly.  And re.findall is not the best choice, because the regex should never match more than once per line (and your code ignores subsequent matches anyway).  Try something like: 

matched = re.search(log_entry_regex, line)
if (matched) 
    yield matched.groups()


This eliminates the array-of-arrays in the result and ensures results are always a set of matches.  if line and int(line[0][8]) &gt;= 1000 becomes just if int(line[8]) &gt;= 1000.

The global variables are better placed inside the functions where they're used.  save_to_file would need to take arguments then, but it's three lines and could just be inline in the main function.

When you have an array with many values, where each value means something different, a useful pattern is to create "fake enums" with constant field identifiers.  It makes your uses of that array easier to write and easier to read.  It doesn't make much difference here, where the code is short and only one element is actually used; however it becomes invaluable as line count and complexity increase.  Python doesn't have constants, variables will work too:

HOST = 0
…
SIZE = 8
…
if int( line[SIZE] ) &gt;= 1000: