import Foundation
let pattern = #"(?ms)EventCode=(4624|4634|4625)\s+.*\.adm"#
let regex = try! NSRegularExpression(pattern: pattern, options: .anchorsMatchLines)
let testString = #"""
03/08/2024 04:19:49 PM
LogName=Security
EventCode=4634
EventType=0
ComputerName=XXX
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=XXX
Keywords=Audit Success
TaskCategory=Logoff
OpCode=Info
Message=An account was logged off.
Subject:
Security ID: DOMINIO\user.adm
Account Name: utente
Account Domain: AMADORI
Logon ID: XXX
Logon Type: 3
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
"""#
let stringRange = NSRange(location: 0, length: testString.utf16.count)
let matches = regex.matches(in: testString, range: stringRange)
var result: [[String]] = []
for match in matches {
var groups: [String] = []
for rangeIndex in 1 ..< match.numberOfRanges {
let nsRange = match.range(at: rangeIndex)
guard !NSEqualRanges(nsRange, NSMakeRange(NSNotFound, 0)) else { continue }
let string = (testString as NSString).substring(with: nsRange)
groups.append(string)
}
if !groups.isEmpty {
result.append(groups)
}
}
print(result)
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Swift 5.2, please visit: https://developer.apple.com/documentation/foundation/nsregularexpression