#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)^(\w{3}\s*\d)\s*(\d\d:\d\d:\d\d)\s*(\w+)"
Local $sString = "Aug 1 18:27:49 knight sshd[20327]: Failed password for illegal user guest from 218.49.183.17 port 49090 ssh2" & @CRLF & _
"Aug 1 18:27:49 knight sshd[20327]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:27:52 knight sshd[20329]: Failed password for admin from 218.49.183.17 port 49266 ssh2" & @CRLF & _
"Aug 1 18:27:56 knight sshd[20331]: Failed password for admin from 218.49.183.17 port 49468 ssh2" & @CRLF & _
"Aug 1 18:27:58 knight sshd[20334]: Illegal user user from 218.49.183.17" & @CRLF & _
"Aug 1 18:27:59 knight sshd[20334]: Failed password for illegal user user from 218.49.183.17 port 49680 ssh2" & @CRLF & _
"Aug 1 18:27:59 knight sshd[20334]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:28:02 knight sshd[20336]: Failed password for root from 218.49.183.17 port 49869 ssh2" & @CRLF & _
"Aug 1 18:28:05 knight sshd[20347]: Failed password for root from 218.49.183.17 port 50063 ssh2" & @CRLF & _
"Aug 1 18:28:12 knight sshd[20349]: Failed password for root from 218.49.183.17 port 50245 ssh2" & @CRLF & _
"Aug 1 18:28:14 knight sshd[20352]: Illegal user test from 218.49.183.17" & @CRLF & _
"Aug 1 18:28:19 knight sshd[20352]: Failed password for illegal user test from 218.49.183.17 port 50671 ssh2" & @CRLF & _
"Aug 1 18:28:19 knight sshd[20352]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:29:55 knight sshd[20402]: Illegal user test from 218.49.183.17" & @CRLF & _
"Aug 1 18:29:56 knight sshd[20402]: Failed password for illegal user test from 218.49.183.17 port 52244 ssh2" & @CRLF & _
"Aug 1 18:29:56 knight sshd[20402]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:29:58 knight sshd[20404]: Illegal user guest from 218.49.183.17" & @CRLF & _
"Aug 1 18:30:02 knight sshd[20406]: Illegal user test from 218.49.183.17" & @CRLF & _
"Aug 1 18:30:03 knight sshd[20404]: Failed password for illegal user guest from 218.49.183.17 port 52416 ssh2" & @CRLF & _
"Aug 1 18:30:03 knight sshd[20404]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:30:03 knight sshd[20406]: Failed password for illegal user test from 218.49.183.17 port 52558 ssh2" & @CRLF & _
"Aug 1 18:30:03 knight sshd[20406]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:30:05 knight sshd[20439]: Failed password for illegal user guest from 218.49.183.17 port 52818 ssh2" & @CRLF & _
"Aug 1 18:30:05 knight sshd[20439]: Illegal user guest from 218.49.183.17" & @CRLF & _
"Aug 1 18:30:05 knight sshd[20439]: error: Could not get shadow information for NOUSER" & @CRLF & _
"Aug 1 18:30:06 knight sshd[20441]: Failed password for admin from 218.49.183.17 port 52851 ssh2" & @CRLF & _
"Aug 1 18:30:08 knight sshd[20443]: Failed password for admin from 218.49.183.17 port 53014 ssh2" & @CRLF & _
"Aug 1 18:30:09 knight sshd[20445]: Failed password for admin from 218.49.183.17 port 53040 ssh2" & @CRLF & _
"Aug 1 18:30:11 knight sshd[20447]: Failed password for admin from 218.49.183.17 port 53192 ssh2"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm