// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"(?m)(?P<syslog_date>\S+\s+\d+\s+\d+:\d+:\d+)\s+0\s+(?P<log_date>\d+-\d+-\d+T\d+:\s\d+:\d+[^\s]+)\s+.*?(?:(?P<device>[^\s:]+)\s+)?(?P<application>ora_[^\s:]+_Audit)\s+-\s+-\s+Audit\[\d+\]:\s+(?:[^]]+]\s+)?(?:LENGTH:\s+\"(?P<length>\d+)\".*?)?SESSIONID:(?:\[\d+\])?\s+\"(?P<sessionid>\d+)\".*?ENTRYID:(?:\[\d+\])?\s+\"(?P<entryid>\d+)\".*?(?:STATEMENT:(?:\[\d+\])?\s+\"(?P<statement>.*?)\")?.*?USERID:(?:\[\d+\])?\s+\"(?P<userid>.*?)\".*?(?:USERHOST:(?:\[\d+\])\s+"(?:(?P<host_domain>[^\\"]+)\\+)?(?P<userhost>[^"]*)")?\s+(?:TERMINAL:(?:\[\d+\])\s+"(?P<terminal>[^"]*)"\s+)?ACTION:(?:\[\d+\])?\s+\"(?P<action>\d+)\".*?RETURNCODE:(?:\[\d+\])?\s+\"(?P<code>.*?)\".*?(?:COMMENT\$TEXT:(?:\[\d+\])?.*?\"Authenticated\s+by:\s+(?P<auth_by>\S+)(?:\;\s+Client\s+address:\s+\(ADDRESS\=\(PROTOCOL\=tcp\)\(HOST\=(?P<host>\d+\.\d+\.\d+\.\d+)\)\(PORT\=(?P<port>\d+)\)\).*?|"\s+)|OBJ\$CREATOR:(?:\[\d+\])?\s+\"(?P<objcreator>[^"]*)"\s+.*?OBJ\$NAME:(?:\[\d+\])?\s+\"(?P<objname>[^"]*)"\s+)OS\$USERID:(?:\[\d+\])?\s+\"(?P<osuserid>[^"]*)"\s*(?:(?!PRIV\$)\S+\s+)*(?:PRIV\$USED:(?:\[\d+\])?\s+"(?P<priv>[^"]*)")?"#).unwrap();
let string = "Mar 31 00:02:54 0 2020-03-31T00: 02:53.629415+02:00 localhost ora_AM_Audit - - Audit[29579]: LENGTH: \"379\" SESSIONID:[9] \"130549450\" ENTRYID:[1] \"1\" STATEMENT:[1] \"1\" USERID:[15] \"EFACTURA_CDATOS\" USERHOST:[9] \"EFPRE-TRX\" ACTION:[3] \"100\" RETURNCODE:[1] \"0\" COMMENT$TEXT:[102] \"Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.200.237)(PORT=44530))\" OS$USERID:[9] \"efamerica\" DBID:[10] \"3787855415\" PRIV$USED:[1] \"5\" CURRENT_USER:[15] \"EFACTURA_CDATOS\"";
// result will be an iterator over tuples containing the start and end indices for each match in the string
let result = regex.captures_iter(string);
for mat in result {
println!("{:?}", mat);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/