use strict;
my $str = 'Sep 09 08:32:28 Qradar_mail_log_monoline: CEF:0|Cisco|C600V Email Security Virtual Appliance|13.0.0-375|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log \'IndiceBusta.xml\' Event|5|deviceExternalId=4218A388D5F87FE03948-AF94EFBF2387 ESAMID=46698525 ESAICID=93560178 ESADCID=12077002 ESAAMPVerdict=NOT_EVALUATED ESAASVerdict=NOT_EVALUATED ESAAVVerdict=NEGATIVE ESACFVerdict=MATCH endTime=Wed Sep 9 08:32:26 2020 ESADLPVerdict=NOT_EVALUATED dvc=172.16.102.105 ESAAttachmentDetails={\'smime.p7s\': {\'BodyScanner\': {}}, \'IndiceBusta.xml\': {\'BodyScanner\': {}}, \'postacert.eml\': {\'BodyScanner\': {}}, \'976739s.pdf\': {\'BodyScanner\': {}}, \'daticert.xml\': {\'BodyScanner\': {}}, \'Comunicazione.xml\': {\'BodyScanner\': {}}, \'MELCARNE=20ANNA=20PAOLA=20-=20NOTE=20TRATTAZIONE=20SCRITTA.pdf.zip\': {\'BodyScanner\': {}}} ESAFriendlyFrom=posta-certificata@telecompost.it ESAGMVerdict=NEGATIVE startTime=Wed Sep 9 08:32:25 2020 deviceInboundInterface=InComing deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=forward.mailbox@forward.telecompost.it cs1Label=MailPolicy cs1=INPS cs2Label=SenderCountry cs2=Italy ESAMFVerdict=MATCH act=DELIVERED cs4Label=ExternalMsgID cs4=\'<1991715585.1180479.1599633145120.JavaMail.root@pecbe1>\'';
my $regex = qr/ESAAttachmentDetails=.*?'(\S+\.\b(?!eml|p7s|xml)\b.*?)'.*?\sESAFriendlyFrom/ip;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html