import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class Example {
public static void main(String[] args) {
final String regex = "(?:rd|ed|USER=|disconnected by|closed)\\s?(?:for)?\\s?(?:invalid\\suser\\s)?(?<user>\\w+)";
final String string = "Sat Jun 03 2017 22:53:03 cisco_router1 sshd[4926]: Failed password for invalid user info from 2.229.4.58 port 4509 ssh2\n"
+ "Sat Jun 03 2017 22:55:37 cisco_router1 sshd[3720]: Failed password for peevish from 2.229.4.58 port 1299 ssh2\n\n"
+ "Sat Jun 03 2017 22:54:09 cisco_router1 sshd[15833]: pam_unix(sshd:session): session opened for user nsharpe by (uid=0)\n\n"
+ "Tue Jul 04 2017 16:59:10 cisco_router1 sshd[64913]: pam_unix(sshd:session): session closed for user nsharpe by (uid=0)\n\n"
+ "Tue Jul 04 2017 14:21:40 cisco_router1 su: pam_unix(su:session): session closed for user root\n\n"
+ "Sat Jun 03 2017 22:55:13 cisco_router1 sshd[1952]: Accepted password for djohnson from 10.3.10.46 port 1182 ssh2\n\n"
+ "Sat Jun 03 2017 22:55:37 cisco_router1 sudo: myuan ; TTY=pts/0 ; PWD=/home/myuan ; USER=root ; COMMAND=/bin/su\n\n"
+ "Tue Jul 04 2017 16:59:10 cisco_router1 sshd[59602]: Received disconnect from 10.2.10.163 11: disconnected by user\n\n\n"
+ "Tue Jul 04 2017 16:59:10 cisco_router1 sshd[59602]: Received disconnect from 10.2.10.163 11: disconnected by user\n\n\n\n";
final Pattern pattern = Pattern.compile(regex);
final Matcher matcher = pattern.matcher(string);
while (matcher.find()) {
System.out.println("Full match: " + matcher.group(0));
for (int i = 1; i <= matcher.groupCount(); i++) {
System.out.println("Group " + i + ": " + matcher.group(i));
}
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Java, please visit: https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html