re = /(?P<Timestamp>\w{3}\s+\d{1,2}\s\d{1,2}:\d{2}:\d{2})\s(?P<A1>\w+)\s(?P<A2>[\S]+)\:\s(?P<A3>.*)/m
str = 'Jan 9 01:04:49 syntax sshd(pam_unix)[21354]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=120-123-141-4.hinet-ip.hinet.com
Jul 10 04:17:11 syntax su(pam_unix)[95367]: session opened for user abc by (uid=0)
May 1 14:06:19 syntax su(pam_unix)[95367]: session closed for user abc
Oct 23 18:08:26 syntax logrotate: ALERT exited abnormally with [1]
Jun 14 21:42:52 syntax su(pam_unix)[95367]: session opened for user cbx by (uid=0)'
# Print the match result
str.scan(re) do |match|
puts match.to_s
end
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html