using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(sudo)(?:\[\d+\])?\:\s+(?:\[[^]]+]\s+)?(\S+)\s*\:\s*TTY=([^ ;]+)\s*;\s*PWD=([^ ;]+)\s*;\s*USER=([^ ;]+)\s*;\s*COMMAND=([^\""]+)";
string input = @"{""xif_srcip"":""10.0.252.164"",""sl_fac"":""authpriv"",""sl_sev"":""notice"",""sl_pri"":""85"",""sl_h"":""security-alerts-test-1"",""message"":""sudo: root : TTY=pts/4 ; PWD=/root ; USER=root ; COMMAND=/sbin/insmod"",""ident"":""sudo"",""xif_pfx"":""syslog"",""xif_fwdr"":""security-fluentd-iad01-ppd-01.us-east-1a.preprod.ntnxi.net"",""xif_fwdrip"":""10.254.0.6"",""xih_s"":""_"",""xif_tag"":""syslog.authpriv"",""time"":""2019-07-17T20:25:45.700914000Z""}";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx