#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)password\s+for\s+(user|(invalid\s+user))\s+(?<User>\w+)\s+from\s+(?<Source_IP>\d+\.\d+\.\d+\.\d+)\s+port\s+(?<Source_Port>\d+)\s+(?<Protocol>\w+)"
Local $sString = "Jun 3 17:29:44 ntp sshd[9668]: Failed password for invalid user XXX from 192.168.111.111 port 63568 ssh2" & @CRLF & _
"· host = ntp 192.168.XXX.XXX" & @CRLF & _
"· source = /var/log/secure" & @CRLF & _
"· sourcetype = linux_secure" & @CRLF & _
"" & @CRLF & _
"Jun 3 17:29:44 XXX sshd[9668]: Failed password for user XXX from 192.168.111.111 port 63568 ssh2" & @CRLF & _
"· host = 10.0.0.XXX" & @CRLF & _
"· source = /var/log/secure" & @CRLF & _
"· sourcetype = linux_secure" & @CRLF & _
"" & @CRLF & _
"Jun 3 00:13:41 XXX sshd[18404]: Accepted password for user XXX from 192.168.111.111 port 60272 ssh2" & @CRLF & _
"· host = 10.0.0.XXX" & @CRLF & _
"· source = /var/log/secure" & @CRLF & _
"· sourcetype = linux_secure"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm