// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time1>\w+).*: pid=(?<pid1>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time2>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time3>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)|type=DAEMON\w+ msg=audit\((?<time4>\w+).*: (?<message1>.*)|type=CONFIG_CHANGE msg=audit\((?<time5>\w+).*: (?<message2>.*)"#).unwrap();
let string = "type=DAEMON_START msg=audit(1450609493.002:6827): auditd start, ver=2.4 format=raw kernel=4.3.0 auid=4294967295 pid=2491 subj=unconfined res=success";
// result will be a tuple containing the start and end indices for the first match in the string
let result = regex.captures(string);
let (start, end) = match result {
Some((s, e)) => (s, e),
None => {
// ...
}
};
println!("{}", &string[start, end]);
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/