re = /changed\sfor:\s'+(?<changed_filename>\S+[^'])/m
str = 'Apr 17 08:09:45 clap ossec: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: clap->syscheck; classification: ossec,syscheck,; Previous MD5: \'0a79ed913a931af0220c0349353ab9ec\'; Current MD5: \'809a2abe99e979b90e9298d3a052a312\'; Previous SHA1: \'814125fb17df21b9a91f8b1f839dac91733f0150\'; Current SHA1: \'3728e27f1f9ab27654ebb72aa6d01219d8624881\'; Size changed: from \'5780\' to \'5950\'; Integrity checksum changed for: \'/home/clapuser/UserDisable/disable.py\''
# Print the match result
str.scan(re) do |match|
puts match.to_s
end
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html