#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "<\d+>\S+\s(\d{4}-\d{2}-\d{2})\s(\d{2}\x3a\d{2}\x3a\d{2}),\d+\s\x5b\d+\x5d\s+\S+\s+\S+\s\S+\s+\S+\s+\S+\s\S+\s\ServerIPAddress\x3a\s\S+\s((?:\d{1,3}\x2e){3}\d{1,3})\s+ClientIPAddress\x3a\s(\S+)\s\S+\s\S+\s\S+\s\S+\s+\S+\s\S+\s+\S+\s\S+\s+\S+\s\S+\s+\S+\s+\S+\s+MessageText\x3a\s(Admin\sActivity)\s+UserId\x3a\s(\d+)\s+UserName\x3a\s(\S+)\s+Action\sDate\/Time\x3a\s+\S+\s\S+\s\S+\s+Portal\sGroup\sId\x3a\s(\d+)\s+Portal Group Name\x3a\s([a-zA-Z\s]+)\s+Action\sType\x3a\s([a-zA-Z\s]+)\sAction\sDetail\x3a([a-zA-Z0-9\.\;\s\:]+)\sArea\sOf\sAdministration\x3a\s(\S+)\s+Portal\sId\x3a\s(\d+)\s+Portal\sName\x3a\s([a-zA-Z0-9\s]+)\s+Enterprise\sUser\x3a\s(\S+)"
Local $sString = "<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:06,965 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider" & @CRLF & _
" ClassName: AuditTrailSqlDao" & @CRLF & _
" MethodName: LogToSysLog" & @CRLF & _
" CustomProps: 6ZalfDCycQw=" & @CRLF & _
" MessageText: Admin Activity" & @CRLF & _
" UserId: 301640" & @CRLF & _
" UserName: myost6" & @CRLF & _
" Action Date/Time: 8/8/2016 1:04:06 PM" & @CRLF & _
" Portal Group Id: 1273153" & @CRLF & _
" Portal Group Name: myCarolinas Admin" & @CRLF & _
" Action Type: Update User" & @CRLF & _
" Action Detail: User updated. User ID: 301640; UserName: myost6; " & @CRLF & _
" Area Of Administration: Users" & @CRLF & _
" Portal Id: 6" & @CRLF & _
" Portal Name: my Carolinas Mobile" & @CRLF & _
" Enterprise User: False" & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:06,965 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider" & @CRLF & _
" ClassName: AuditTrailSqlDao" & @CRLF & _
" MethodName: LogToSysLog" & @CRLF & _
" CustomProps: 6ZalfDCycQw=" & @CRLF & _
" MessageText: Admin Activity" & @CRLF & _
" UserId: 301640" & @CRLF & _
" UserName: myost6" & @CRLF & _
" Action Date/Time: 8/8/2016 1:04:06 PM" & @CRLF & _
" Portal Group Id: 1273153" & @CRLF & _
" Portal Group Name: myCarolinas Admin" & @CRLF & _
" Action Type: Update User" & @CRLF & _
" Action Detail: User updated. User ID: 301640; UserName: myost6; " & @CRLF & _
" Area Of Administration: Users" & @CRLF & _
" Portal Id: 6" & @CRLF & _
" Portal Name: my Carolinas Mobile" & @CRLF & _
" Enterprise User: False " & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:12,815 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider" & @CRLF & _
" ClassName: AuditTrailSqlDao" & @CRLF & _
" MethodName: LogToSysLog" & @CRLF & _
" CustomProps: 6ZalfDCycQw=" & @CRLF & _
" MessageText: Admin Activity" & @CRLF & _
" UserId: 244010" & @CRLF & _
" UserName: katdbod" & @CRLF & _
" Action Date/Time: 8/8/2016 1:04:12 PM" & @CRLF & _
" Portal Group Id: 1273153" & @CRLF & _
" Portal Group Name: myCarolinas Admin" & @CRLF & _
" Action Type: Update User" & @CRLF & _
" Action Detail: User updated. User ID: 244010; UserName: katdbod; " & @CRLF & _
" Area Of Administration: Users" & @CRLF & _
" Portal Id: 2" & @CRLF & _
" Portal Name: myCarolinas" & @CRLF & _
" Enterprise User: False" & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:12,815 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider%0D ClassName: AuditTrailSqlDao%0D MethodName: LogToSysLog%0D CustomProps: 6ZalfDCycQw=%0D MessageText: Admin Activity%0D UserId: 244010%0D UserName: katdbod%0D Action Date/Time: 8/8/2016 1:04:12 PM%0D Portal Group Id: 1273153%0D Portal Group Name: myCarolinas Admin%0D Action Type: Update User%0D Action Detail: User updated. User ID: 244010; UserName: katdbod; %0D Area Of Administration: Users%0D Portal Id: 2%0D Portal Name: myCarolinas%0D Enterprise User: False%0D " & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:12,971 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider%0D ClassName: AuditTrailSqlDao%0D MethodName: LogToSysLog%0D CustomProps: 6ZalfDCycQw=%0D MessageText: Admin Activity%0D UserId: 244010%0D UserName: katdbod%0D Action Date/Time: 8/8/2016 1:04:12 PM%0D Portal Group Id: 1273153%0D Portal Group Name: myCarolinas Admin%0D Action Type: Update User%0D Action Detail: User updated. User ID: 244010; UserName: katdbod; %0D Area Of Administration: Users%0D Portal Id: 2%0D Portal Name: myCarolinas%0D Enterprise User: False%0D " & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:12,971 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider%0D ClassName: AuditTrailSqlDao%0D MethodName: LogToSysLog%0D CustomProps: 6ZalfDCycQw=%0D MessageText: Admin Activity%0D UserId: 244010%0D UserName: katdbod%0D Action Date/Time: 8/8/2016 1:04:12 PM%0D Portal Group Id: 1273153%0D Portal Group Name: myCarolinas Admin%0D Action Type: Update User%0D Action Detail: User updated. User ID: 244010; UserName: katdbod; %0D Area Of Administration: Users%0D Portal Id: 2%0D Portal Name: myCarolinas%0D Enterprise User: False%0D " & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:33,766 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider%0D ClassName: AuditTrailSqlDao%0D MethodName: LogToSysLog%0D CustomProps: 6ZalfDCycQw=%0D MessageText: Admin Activity%0D UserId: 164664%0D UserName: rrrleigh%0D Action Date/Time: 8/8/2016 1:04:33 PM%0D Portal Group Id: 1273153%0D Portal Group Name: myCarolinas Admin%0D Action Type: Change User Password%0D Action Detail: Password changed for user. User ID: 164664; %0D Area Of Administration: Users%0D Portal Id: 2%0D Portal Name: myCarolinas%0D Enterprise User: False%0D " & @CRLF & _
"<190>MedSeekBusinessServer.exe: 2016-08-08 09:04:33,766 [4] INFO MedSeek.Portal.Server.LoggingProvider.Data.AuditTrailSqlDao UserID: -9999 UserName: System ServerIPAddress: 10.247.82.26 10.247.82.112 ClientIPAddress: (null) PortalId: (null) PortalName: (null) AssemblyName: MedSeek.Portal.Server.LoggingProvider%0D ClassName: AuditTrailSqlDao%0D MethodName: LogToSysLog%0D CustomProps: 6ZalfDCycQw=%0D MessageText: Admin Activity%0D UserId: 164664%0D UserName: rrrleigh%0D Action Date/Time: 8/8/2016 1:04:33 PM%0D Portal Group Id: 1273153%0D Portal Group Name: myCarolinas Admin%0D Action Type: Change User Password%0D Action Detail: Password changed for user. User ID: 164664; %0D Area Of Administration: Users%0D Portal Id: 2%0D Portal Name: myCarolinas%0D Enterprise User: False%0D " & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYFULLMATCH)
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm