#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?i)ESAAttachmentDetails=.*?'(\S+\.\b(?!eml|p7s|xml)\b.*?)'.*?\sESAFriendlyFrom"
Local $sString = "Sep 09 08:32:28 Qradar_mail_log_monoline: CEF:0|Cisco|C600V Email Security Virtual Appliance|13.0.0-375|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log 'IndiceBusta.xml' Event|5|deviceExternalId=4218A388D5F87FE03948-AF94EFBF2387 ESAMID=46698525 ESAICID=93560178 ESADCID=12077002 ESAAMPVerdict=NOT_EVALUATED ESAASVerdict=NOT_EVALUATED ESAAVVerdict=NEGATIVE ESACFVerdict=MATCH endTime=Wed Sep 9 08:32:26 2020 ESADLPVerdict=NOT_EVALUATED dvc=172.16.102.105 ESAAttachmentDetails={'smime.p7s': {'BodyScanner': {}}, 'IndiceBusta.xml': {'BodyScanner': {}}, 'postacert.eml': {'BodyScanner': {}}, '976739s.pdf': {'BodyScanner': {}}, 'daticert.xml': {'BodyScanner': {}}, 'Comunicazione.xml': {'BodyScanner': {}}, 'MELCARNE=20ANNA=20PAOLA=20-=20NOTE=20TRATTAZIONE=20SCRITTA.pdf.zip': {'BodyScanner': {}}} ESAFriendlyFrom=posta-certificata@telecompost.it ESAGMVerdict=NEGATIVE startTime=Wed Sep 9 08:32:25 2020 deviceInboundInterface=InComing deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=forward.mailbox@forward.telecompost.it cs1Label=MailPolicy cs1=INPS cs2Label=SenderCountry cs2=Italy ESAMFVerdict=MATCH act=DELIVERED cs4Label=ExternalMsgID cs4='<1991715585.1180479.1599633145120.JavaMail.root@pecbe1>'"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm