// include the latest version of the regex crate in your Cargo.toml
extern crate regex;
use regex::Regex;
fn main() {
let regex = Regex::new(r#"(?m)(sudo)(?:\[\d+\])?\:\s+(?:\[[^]]+]\s+)?(\S+)\s*\:\s*TTY=([^ ;]+)\s*;\s*PWD=([^ ;]+)\s*;\s*USER=([^ ;]+)\s*;\s*COMMAND=([^\"]+)"#).unwrap();
let string = "{\"xif_srcip\":\"10.0.252.164\",\"sl_fac\":\"authpriv\",\"sl_sev\":\"notice\",\"sl_pri\":\"85\",\"sl_h\":\"security-alerts-test-1\",\"message\":\"sudo: root : TTY=pts/4 ; PWD=/root ; USER=root ; COMMAND=/sbin/insmod\",\"ident\":\"sudo\",\"xif_pfx\":\"syslog\",\"xif_fwdr\":\"security-fluentd-iad01-ppd-01.us-east-1a.preprod.ntnxi.net\",\"xif_fwdrip\":\"10.254.0.6\",\"xih_s\":\"_\",\"xif_tag\":\"syslog.authpriv\",\"time\":\"2019-07-17T20:25:45.700914000Z\"}";
// result will be an iterator over tuples containing the start and end indices for each match in the string
let result = regex.captures_iter(string);
for mat in result {
println!("{:?}", mat);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Rust, please visit: https://docs.rs/regex/latest/regex/