#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)^t=(?<longtime>[^ ]+)\s*lvl=(?<loglevel>[^ ]+)\s*msg=(?<msg>(?:"[^"]+"|[^ ]+))\s*logger=(?<logger>[^ ]+)\s*(?:addresses=(?<email>(?:"\[[^"]+\]"|[^ ]+)))?(?:userId=(?<userID>[^ ]+))?\s*(?:orgId=(?<orgID>[^ ]+))?\s*(?:uname=(?<uname>[^ ]+|[??]*))?\s*(?:method=(?<method>[^ ]+))?\s*(?:path=(?<path>(?:"[^"]+"|[^ ]+)))?\s*(?:ruleId=(?<ruleID>[^ ]+))?\s*(?:name=(?<name>(?:"[^"]+"|[^ ]+)))?\s*(?:error=(?<error>(?:"[^"]+"|[^ ]+)))?\s*(?:changing state to=(?<ChStateTo>[^ ]+))?\s*(?:status=(?<status>[^ ]+))?\s*(?:remote_addr=(?<remote_addr>[^ ]+))?\s*(?:time_ms=(?<time_ms>[^ ]+))?\s*(?:size=(?<size>[^ ]+))?\s*(?:referer=(?<referer>(?:"[^"]+"|[^ ]+)|[??]*))?\s*(?:alertId=(?<alertID>[^ ]+))?\s*(?:newState=(?<NewState>[^ ]+))?\s*(?:prev state=(?<prevState>[^ ]+))?\s*(?:url=(?<url>[^ ]+))?$"
Local $sString = "t=2019-07-30T07:22:35+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=22 name="Выдача сломалась!" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:39+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=48 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:39+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/TylgxQWG4Aiq6kmlSrM4.png" & @CRLF & _
"t=2019-07-30T07:22:39+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/lsfc738fTMkR034AZM2j.png" & @CRLF & _
"t=2019-07-30T07:22:39+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook" & @CRLF & _
"t=2019-07-30T07:22:39+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook" & @CRLF & _
"t=2019-07-30T07:22:40+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=89 name=Вход.Формы.Статусы error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:40+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=89 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:40+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=88 name="Exception State alert" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:40+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/tQeLMXFNBU6y6USKOe5E.png" & @CRLF & _
"t=2019-07-30T07:22:40+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook" & @CRLF & _
"t=2019-07-30T07:22:42+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=21 name="HermesApiErrors alert" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:42+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=26 name="Генерация отчетов на Jasper alert" error="Alert execution exceeded the timeout" changing state to=keep_state" & @CRLF & _
"t=2019-07-30T07:22:45+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=32 name="СРВО. Фоновые задачи" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:45+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=32 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:45+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/yZzqi4QmGCvSbYraq3UC.png" & @CRLF & _
"t=2019-07-30T07:22:45+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook" & @CRLF & _
"t=2019-07-30T07:22:45+0300 lvl=info msg="Sending alert notification to" logger=alerting.notifier.email addresses="[Andrey.Kudashkin@russianpost.ru Arkhipov.Alexander@russianpost.ru szhogin@luxoft.com OPodus@luxoft.com]"" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=135 name="pochtaid-sso alert" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=135 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=90 name="Профиль. Статус" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=90 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=eror msg="Alert Rule Result Error" logger=alerting.evalContext ruleId=136 name="Normalization alert" error="Alert execution exceeded the timeout" changing state to=alerting" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="New state change" logger=alerting.resultHandler alertId=136 newState=alerting prev state=ok" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/qXR85haxAmRX5g1vqrmT.png" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/dOfYePDh7n3oreQhaRCR.png" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="Sending webhook" logger=alerting.notifier.webhook" & @CRLF & _
"t=2019-07-30T07:22:47+0300 lvl=info msg="uploaded screenshot of alert to external image store" logger=alerting.notifier url=http://10.233.60.59:8080/grafana/4eIoX3qCRuF16DoXNbRU.png" & @CRLF & _
""
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm