#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)(\w{3} \d* [\d:]*).*usr="([a-z\\]*)".*dstname=([\w.]*).*arg=([\/][^ ]*)"
Local $sString = "May 1 08:21:02 192.168.1.1 id=firewall sn=fakeserial time="2020-05-01 12:21:02 UTC" fw=1.2.3.4 pri=3 c=4 m=14 msg="Web site access denied" app=2515 sess="Auto" n=398533 usr="sampledomain\username" src=192.168.1.150:50334:X0 dst=72.21.81.240:80:X1 srcMac=b0:00:b4:18:4a:b5 dstMac=c0:ea:e4:9d:a0:8c proto=tcp/http dstname=ctldl.windowsupdate.com arg=/gen_204?atyp=i&zx=1588539000507&ogsr=1&ei=dy6vXv6PNbGRggefsqLQBg&ct=7&cad=i&id=19014990&loc=imghp&prid=2&ogd=com code=99 Category="Administrative Custom List settings" fw_action="drop" " & @CRLF & _
"" & @CRLF & _
"" & @CRLF & _
"May 1 08:21:02 192.168.1.1 id=firewall sn=fakeserial time="2020-05-01 12:21:02 UTC" fw=1.2.3.4 pri=3 c=4 m=14 msg="Web site access denied" app=2515 sess="Auto" n=398533 usr="sampledomain\username" src=192.168.1.150:50334:X0 dst=72.21.81.240:80:X1 srcMac=b0:00:b4:18:4a:b5 dstMac=c0:ea:e4:9d:a0:8c proto=tcp/http dstname=ctldl.windowsupdate.com arg=/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab code=99 Category="Administrative Custom List settings" fw_action="drop""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm