re = /(?m)^(?<time>.*?)\s(?<collector_IP_Address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s\w+\:\s(?<Type>.*)#(?<Alert_id>.*),\sstart\s(?<start_time>.*),\sduration\s(?<duration>\d+),\sdirection\s(?<direction>\w+),\shost\s(?<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),\ssignatures\s\((?<signatures>.*)\),\simpact\s(?<impact>.*),\simportance\s(?<importance>\d+),\smanaged_objects\s\(\"(?<managed_objects>\w+)\"\),\s\(parent\smanaged\sobject\s\"(?<parent_managed_object>\w+)\"\)/
str = 'Dec 5 18:04:51 192.168.69.50 pfsp: Host Detection alert #22049413, start 2017-12-06 00:03:45 GMT, duration 66, direction incoming, host 71.92.104.13, signatures (ICMP, IP Fragmentation, Total Traffic, UDP, DNS Amplification), impact 4.00 Gbps/386.20 Kpps, importance 2, managed_objects ("Tonga"), (parent managed object "nil")
Dec 5 16:19:51 192.168.69.50 pfsp: Host Detection alert #22049331, start 2017-12-05 22:16:45 GMT, duration 186, direction incoming, host 24.177.66.30, signatures (ICMP, IP Fragmentation, TCP NULL, TCP SYN, TCP RST, Total Traffic, UDP), impact 310.64 Mbps/104.45 Kpps, importance 2, managed_objects ("Tonga"), (parent managed object "nil")'
# Print the match result
str.scan(re) do |match|
puts match.to_s
end
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html