// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"(Data\": )\""#).unwrap();
let string = "Event 1 :
=========
Input Event : [so much data exists in the same single line ] ,\\\"Comments\\\": \\\"New alert\\\", \"Data\": \"{\\\"etype\\\":\\\"MalwareFamily\\\",\\\"at\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"md\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"Investigations\\\":[{\\\"$id\\\":\\\"1\\\",\\\"Id\\\":\\\"urn:ZappedUrlInvestigation:2cc87ae3\\\",\\\"InvestigationStatus\\\":\\\"Running\\\"}],\\\"InvestigationIds\\\":[\\\"urn:ZappedUrlInvestigation:2cc8782d063\\\"],\\\"Intent\\\":\\\"Probing\\\",\\\"ResourceIdentifiers\\\":[{\\\"$id\\\":\\\"2\\\",\\\"AadTenantId\\\":\\\"2dfb29-729c918\\\",\\\"Type\\\":\\\"AAD\\\"}],\\\"AzureResourceId\\\":null,\\\"WorkspaceId\\\":null,\\\"Metadata\\\":{\\\"CustomApps\\\":null,\\\"GenericInfo\\\":null},\\\"Entities\\\":[{\\\"$id\\\":\\\"3\\\",\\\"MailboxPrimaryAddress\\\":\\\"abc@gmail.com\\\",\\\"Upn\\\":\\\"abc@gmail.com\\\",\\\"AadId\\\":\\\"6eac3b76357\\\",\\\"RiskLevel\\\":\\\"None\\\",\\\"Type\\\":\\\"mailbox\\\",\\\"Urn\\\":\\\"urn:UserEntity:10338af2b6c\\\",\\\"Source\\\":\\\"TP\\\",\\\"FirstSeen\\\":\\\"0001-01-01T00:00:00\\\"}, \\\"StartTimeUtc\\\": \\\"2024-06-21T10:12:37\\\", \\\"Status\\\": \\\"Investigation Started\\\"}\",\"EntityType\": \"MalwareFamily\", [so much data exists in the same single line ]
Event 2 :
=======
[so much data exists in the same single line ] ,\\\"Comments\\\": \\\"New alert\\\", \"Data\": \"{\\\"etype\\\":\\\"MalwareFamily\\\",\\\"at\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"md\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"Investigations\\\":[{\\\"$id\\\":\\\"1\\\",\\\"Id\\\":\\\"urn:ZappedUrlInvestigation:2cc87ae3\\\",\\\"InvestigationStatus\\\":\\\"Running\\\"}],\\\"InvestigationIds\\\":[\\\"urn:ZappedUrlInvestigation:2cc8782d063\\\"],\\\"Intent\\\":\\\"Probing\\\",\\\"ResourceIdentifiers\\\":[{\\\"$id\\\":\\\"2\\\",\\\"AadTenantId\\\":\\\"2dfb29-729c918\\\",\\\"Type\\\":\\\"AAD\\\"}],\\\"AzureResourceId\\\":null,\\\"WorkspaceId\\\":null,\\\"Metadata\\\":{\\\"CustomApps\\\":null,\\\"GenericInfo\\\":null},\\\"Entities\\\":[{\\\"$id\\\":\\\"3\\\",\\\"MailboxPrimaryAddress\\\":\\\"abc@gmail.com\\\",\\\"Upn\\\":\\\"abc@gmail.com\\\",\\\"AadId\\\":\\\"6eac3b76357\\\",\\\"RiskLevel\\\":\\\"None\\\",\\\"Type\\\":\\\"mailbox\\\",\\\"Urn\\\":\\\"urn:UserEntity:10338af2b6c\\\",\\\"Source\\\":\\\"TP\\\",\\\"FirstSeen\\\":\\\"0001-01-01T00:00:00\\\"}, \\\"StartTimeUtc\\\": \\\"2024-06-21T10:12:37\\\", \\\"Status\\\": \\\"Investigation Started\\\"}\",\"ids\": [9654,\"78b3\"], [so much data exists in the same single line ]
Event 3 :
==========
[so much data exists in the same single line ] ,\\\"Comments\\\": \\\"New alert\\\", \"Data\": \"{\\\"etype\\\":\\\"MalwareFamily\\\",\\\"at\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"md\\\":\\\"2024-06-21T11:34:07.0000000Z\\\",\\\"Investigations\\\":[{\\\"$id\\\":\\\"1\\\",\\\"Id\\\":\\\"urn:ZappedUrlInvestigation:2cc87ae3\\\",\\\"InvestigationStatus\\\":\\\"Running\\\"}],\\\"InvestigationIds\\\":[\\\"urn:ZappedUrlInvestigation:2cc8782d063\\\"],\\\"Intent\\\":\\\"Probing\\\",\\\"ResourceIdentifiers\\\":[{\\\"$id\\\":\\\"2\\\",\\\"AadTenantId\\\":\\\"2dfb29-729c918\\\",\\\"Type\\\":\\\"AAD\\\"}],\\\"AzureResourceId\\\":null,\\\"WorkspaceId\\\":null,\\\"Metadata\\\":{\\\"CustomApps\\\":null,\\\"GenericInfo\\\":null},\\\"Entities\\\":[{\\\"$id\\\":\\\"3\\\",\\\"MailboxPrimaryAddress\\\":\\\"abc@gmail.com\\\",\\\"Upn\\\":\\\"abc@gmail.com\\\",\\\"AadId\\\":\\\"6eac3b76357\\\",\\\"RiskLevel\\\":\\\"None\\\",\\\"Type\\\":\\\"mailbox\\\",\\\"Urn\\\":\\\"urn:UserEntity:10338af2b6c\\\",\\\"Source\\\":\\\"TP\\\",\\\"FirstSeen\\\":\\\"0001-01-01T00:00:00\\\"}, \\\"StartTimeUtc\\\": \\\"2024-06-21T10:12:37\\\", \\\"Status\\\": \\\"Investigation Started\\\"}\",\"Name\": \"Phishing Categroy\", [so much data exists in the same single line ]
======
";
let substitution = "$1[";
// result will be a String with the substituted value
let result = regex.replace_all(string, substitution);
println!("{}", result);
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/