re = /<AUDT:INFO>.(?<date>\d+.\d+.\d+) (?:\d+:\d+:\d+) (?<dip>\d+.\d+.\d+.\d+) (?:.*(?<subject>Successful Active Directory login)(?:.\w+.\w+)(?<account>.*?\W))\w+.\w+.\w+.\w+.'(?<sip>.\d+.\d+.\d+.\d+)'.*$/m
str = '08 21 2020 08:32:25 10.72.1.17 <AUDT:INFO> 2020-08-21 08:31:58 10.72.1.17 Passwordstate: Successful Active Directory login for UserID \'fakedoamin\\FakeUser\' from the IP Address \'10.72.1.17\'. Client IP Address = 10.72.1.93
'
# Print the match result
str.scan(re) do |match|
puts match.to_s
end
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html