use strict;
my $str = '\\"EventTime\\":\\"2017-08-11 10:40:07\\",\\"Hostname\\":\\"School4\\",\\"Keywords\\":-9187343239835811840,\\"EventType\\":\\"INFO\\",\\"SeverityValue\\":2,\\"Severity\\":\\"INFO\\",\\"EventID\\":7036,\\"SourceName\\":\\"Service Control Manager\\",\\"ProviderGuid\\":\\"{555908D1-A6D7-4695-8E1E-26931D2012F4}\\",\\"Version\\":0,\\"Task\\":0,\\"OpcodeValue\\":0,\\"RecordNumber\\":263066,\\"ProcessID\\":548,\\"ThreadID\\":7528,\\"Channel\\":\\"System\\",\\"Message\\":\\"Application Experience \\xBC\\xAD\\xBA\\u{7DEB0}\\xA1 \\xC1\\xDF\\xC1\\xF6 \\xBB\\xF3\\xC5·\\xCE \\xB5\\xE9\\xBE\\xBD\\xC0\\xB4ϴ\\xD9.\\",\\"param1\\":\\"Application Experience\\",\\"param2\\":\\"\\xC1\\xDF\\xC1\\xF6\\",\\"EventReceivedTime\\":1502415607,\\"SourceModuleName\\":\\"in\\",\\"SourceModuleType\\":\\"im_msvistalog\\"';
my $regex = qr/\W+\w+\W+(?<EventTime>[^\\]+)\W+\w+\W+(?<HostName>[^\\]+).+?EventID\W+(?<EventID>[^,]+).+?Message\W+(?<Message>[^,]+(?=\\)).+/p;
if ( $str =~ /$regex/ ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html