// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"(?m)(("Data": ("){)(\\\".*){1,}(}("),))"#).unwrap();
let string = "[so much data exists in the same single line ] ,\"Comments\": \"New alert\", \"Data\": \"{\\\"etype\\\":\\\"MalwareFamily\\\",\\\"at\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"md\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"Investigations\\\":[{\\\"$id\\\":\\\"1\\\",\\\"Id\\\":\\\"urn:ZappedUrlInvestigation:2cc87ae3\\\",\\\"InvestigationStatus\\\":\\\"Running\\\"}],\\\"InvestigationIds\\\":[\\\"urn:ZappedUrlInvestigation:2cc8782d063\\\"],\\\"Intent\\\":\\\"Probing\\\",\\\"ResourceIdentifiers\\\":[{\\\"$id\\\":\\\"2\\\",\\\"AadTenantId\\\":\\\"2dfb29-729c918\\\",\\\"Type\\\":\\\"AAD\\\"}],\\\"AzureResourceId\\\":null,\\\"WorkspaceId\\\":null,\\\"Metadata\\\":{\\\"CustomApps\\\":null,\\\"GenericInfo\\\":null},\\\"Entities\\\":[{\\\"$id\\\":\\\"3\\\",\\\"MailboxPrimaryAddress\\\":\\\"abc@gmail.com\\\",\\\"Upn\\\":\\\"abc@gmail.com\\\",\\\"AadId\\\":\\\"6eac3b76357\\\",\\\"RiskLevel\\\":\\\"None\\\",\\\"Type\\\":\\\"mailbox\\\",\\\"Urn\\\":\\\"urn:UserEntity:10338af2b6c\\\",\\\"Source\\\":\\\"TP\\\",\\\"FirstSeen\\\":\\\"0001-01-01T00:00:00\\\"}, \\\"StartTimeUtc\\\": \\\"2024-06-21T10:12:37\\\", \\\"Status\\\": \\\"Investigation Started\\\"}\", \"EntityType\": \"MalwareFamily\", [so much data exists in the same single line ]";
// result will be an iterator over tuples containing the start and end indices for each match in the string
let result = regex.captures_iter(string);
for mat in result {
println!("{:?}", mat);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/