#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?i)\n\s\sname:\sI_LOGON_AUTH_FAILED\n[\s\S]*?\s\ssession\n[\s\S]*?\s\s\s\sremoteAddress:\s(?<ipaddress>.*?):[0-9]*\n[\s\S]*?\s\sauthentication\n[\s\S]*?\s\s\s\suserName:\s(?<username>.*)"
Local $sString = "event" & @CRLF & _
" time: 2021-11-23 22:42:59.164039 +0300" & @CRLF & _
" app: BvSshServer 8.49" & @CRLF & _
" name: I_LOGON_AUTH_FAILED" & @CRLF & _
" desc: User authentication failed." & @CRLF & _
" session" & @CRLF & _
" id: 1015" & @CRLF & _
" service: SSH" & @CRLF & _
" remoteAddress: 192.168.0.103:41104" & @CRLF & _
" authentication" & @CRLF & _
" attemptNr: 1" & @CRLF & _
" serialize: completion" & @CRLF & _
" userName: userTest" & @CRLF & _
" method: keyboard-interactive" & @CRLF & _
" submethod: Password" & @CRLF & _
" windowsAccount: DESKTOP-FN3LTFE\paprikar" & @CRLF & _
" parameters" & @CRLF & _
" failureReason: BadCredentials" & @CRLF & _
" help" & @CRLF & _
" message: Unknown user name or incorrect password." & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYFULLMATCH)
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm