regex101: PCRE (Legacy) Match Workspace

(?ms)applies the following effective flags to the remainder of the pattern: gms

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

s modifier: single line. Allows a dot to match line terminators

Soggetto:the literal text Soggetto: (case sensitive)

.*any character, repeated any number of times

Nome account:the literal text Nome account: (case sensitive)

\s+any whitespace character, repeated at least once

Group Account_Name(?<Account_Name>\w+)

\w+any word character, repeated at least once

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

(?ms)Soggetto:.*Nome account:\s+(?<Account_Name>\w+)

Test String
New

02/05/2020 04:07:47 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4672
EventType=0
Type=Informazioni
ComputerName=DESKTOP-KBVMP9Q
TaskCategory=Special Logon
OpCode=Informazioni
RecordNumber=198624
Keywords=Controllo riuscito
Message=Privilegi speciali assegnati a nuovo accesso.

Soggetto:
	ID sicurezza:		S-1-5-18
	Nome account:		SYSTEM
	Dominio account:		NT AUTHORITY
	ID accesso:		0x3E7

Privilegi:		SeAssignPrimaryTokenPrivilege
			SeTcbPrivilege
			SeSecurityPrivilege
			SeTakeOwnershipPrivilege
			SeLoadDriverPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeAuditPrivilege
			SeSystemEnvironmentPrivilege
			SeImpersonatePrivilege
			SeDelegateSessionUserImpersonatePrivilege

Regular Expressions 101

Regular Expression

Test String
New

Substitution
Processing...

Regular Expression

Test StringNew

SubstitutionProcessing...

Test String
New

Substitution
Processing...