#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "\W+\w+\W+(?<EventTime>[^\\]+)\W+\w+\W+(?<HostName>[^\\]+).+?EventID\W+(?<EventID>[^,]+).+?Message\W+(?<Message>[^,]+(?=\\)).+"
Local $sString = "\"EventTime\":\"2017-08-11 10:40:07\",\"Hostname\":\"School4\",\"Keywords\":-9187343239835811840,\"EventType\":\"INFO\",\"SeverityValue\":2,\"Severity\":\"INFO\",\"EventID\":7036,\"SourceName\":\"Service Control Manager\",\"ProviderGuid\":\"{555908D1-A6D7-4695-8E1E-26931D2012F4}\",\"Version\":0,\"Task\":0,\"OpcodeValue\":0,\"RecordNumber\":263066,\"ProcessID\":548,\"ThreadID\":7528,\"Channel\":\"System\",\"Message\":\"Application Experience \xBC\xAD\xBA\u{7DEB0}\xA1 \xC1\xDF\xC1\xF6 \xBB\xF3\xC5·\xCE \xB5\xE9\xBE\xBD\xC0\xB4ϴ\xD9.\",\"param1\":\"Application Experience\",\"param2\":\"\xC1\xDF\xC1\xF6\",\"EventReceivedTime\":1502415607,\"SourceModuleName\":\"in\",\"SourceModuleType\":\"im_msvistalog\""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYFULLMATCH)
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm