regex101: PCRE (Legacy) Match Workspace

Group 1(\w*)

\w*any word character, repeated any number of times

=the literal = (61₁₀ / 75₈ / 3D₁₆)

Group 2(\".*?\"|\S*)

1st Alternative\".*?\"

\"the literal " (34₁₀ / 42₈ / 22₁₆)

.*?any character (except for line terminators), repeated any number of times

\"the literal " (34₁₀ / 42₈ / 22₁₆)

2nd Alternative\S*

\S*any non-whitespace character, repeated any number of times

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

Search reference

Regular Expression

(\w*)=(\".*?\"|\S*)

New

Message meets Alert condition

date=2020-08-20 time=00:33:57 devname=FGT3HD3999906624 devid=FGT3HD3999906624 logid="0100032003" type="event" subtype="system" level="information" vd="root" eventtime=1597847637407862934 tz="+1000" logdesc="Admin logout successful" sn="159999794" user="admin" ui="https(10.198.199.105)" method="https" srcip=10.198.199.105 dstip=192.168.23.254 action="logout" status="success" duration=4843 reason="timeout" msg="Administrator admin timed out on https(10.198.199.105)"

Administrator IT Administrator Ph:

Regular Expressions 101

Regular Expression

Extraction