using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(?:AzureFirewallNetworkRule|AzureFirewallApplicationRule).*?(?<=to\s)(?<dest>[^(?:\.\s)].*)";
string input = @"{""category"": ""AzureFirewallNetworkRule"", ""time"": ""2023-03-29T20:00:53.4378840Z"", ""resourceId"": ""/SUBSCRIPTIONS/CA41E67C-1C2F-47D5-9252-402EDF21E20F/RESOURCEGROUPS/RG-PROD-CONNECTIVITY-EUS2/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZFW-HUB-PROD-EUS2"", ""operationName"": ""AzureFirewallNetworkRuleLog"", ""properties"": {""msg"": ""ICMP Type=8 request from 10.0.2.5 to 10.252.0.133. Action: Allow. Policy: afwp-hub-prod-eus2. Rule Collection Group: global. Rule Collection: Allowed-Network-Rules. Rule: QuadToAzurePing""}}
{""category"": ""AzureFirewallNetworkRule"", ""time"": ""2023-03-29T19:54:03.8947510Z"", ""resourceId"": ""/SUBSCRIPTIONS/CA41E67C-1C2F-47D5-9252-402EDF21E20F/RESOURCEGROUPS/RG-PROD-CONNECTIVITY-EUS2/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZFW-HUB-PROD-EUS2"", ""operationName"": ""AzureFirewallNetworkRuleLog"", ""properties"": {""msg"": ""TCP request from 10.252.0.158:50458 to 161.49.232.168:10002. Action: Allow. Policy: afwp-hub-prod-eus2. Rule Collection Group: global. Rule Collection: Allowed-Network-Rules. Rule: AzureToQuadInternalF5""}}
{""category"": ""AzureFirewallApplicationRule"", ""time"": ""2023-03-29T14:46:55.5760760Z"", ""resourceId"": ""/SUBSCRIPTIONS/CA41E67C-1C2F-47D5-9252-402EDF21E20F/RESOURCEGROUPS/RG-PROD-CONNECTIVITY-EUS2/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZFW-HUB-PROD-EUS2"", ""operationName"": ""AzureFirewallApplicationRuleLog"", ""properties"": {""msg"": ""HTTPS request from 10.252.0.158:50868 to login.microsoftonline.com:443. Action: Allow. Policy: afwp-hub-prod-eus2. Rule Collection Group: global. Rule Collection: Allowed-Application-Rules. Rule: AzureAD""}}
{""category"": ""AzureFirewallApplicationRule"", ""time"": ""2023-03-29T20:50:13.0977850Z"", ""resourceId"": ""/SUBSCRIPTIONS/CA41E67C-1C2F-47D5-9252-402EDF21E20F/RESOURCEGROUPS/RG-PROD-CONNECTIVITY-EUS2/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/AZFW-HUB-PROD-EUS2"", ""operationName"": ""AzureFirewallApplicationRuleLog"", ""properties"": {""msg"": ""HTTP request from 10.252.0.158:50039 to google.com:80. Action: Deny. No rule matched. Proceeding with default action""}}";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx