Group event_message(?P<event_message>User initiated logoff:) User initiated logoff:the literal text User initiated logoff: (case sensitive) \s+any whitespace character, repeated at least once
Subject:the literal text Subject: (case sensitive) \s+any whitespace character, repeated at least once
Security ID:the literal text Security ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_security_id(?P<subject_security_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Name:the literal text Account Name: (case sensitive) Group subject_account_name(?P<subject_account_name>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Account Domain:the literal text Account Domain: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_account_domain(?P<subject_account_domain>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Logon ID:the literal text Logon ID: (case sensitive) \s+any whitespace character, repeated at least once
Group subject_logon_id(?P<subject_logon_id>.*?) .*?any character (except for line terminators), repeated any number of times
\s+any whitespace character, repeated at least once
Group event_details(?P<event_details>.*) .*any character (except for line terminators), repeated any number of times
g modifier: global. Finds all matches instead of stopping after the first