title: Regex possible with sometimes deviating rules in log?
body: <p>I want to create a tool with which I can analyse a log.</p>
  <p>However, the log file is a trace of an application where sometimes abnormal things happen such as:</p>
  <ul>
  <li>An event spread over several lines.</li>
  <li>The text sometimes also contains characters that I want to filter on in a split function.</li>
  </ul>
  <p>Now I am trying to use a regex to get all the values out of this trace log, is this really possible because of the deviations in the log?</p>
  <p><strong>The log includes a few deviations that may occur:</strong></p>
  <pre class="lang-none prettyprint-override"><code>[111111111111111] [22222222] [33][4][5555] [6666.............text..........6666] [7777777]
  19.03.21 18:45:48 EF22       37D8 2 TIMEST 02 TIGetTicketImprintingLayoutStart:  :13254125
  19.03.21 18:45:48 EF22       37D8 2 TIMEST 02 TIGetTicketImprintingLayoutEnd:  :13254140
  19.03.21 18:46:11 EF21       36C8 1 TIMEST 00 PdlActivated: OnAWS :13276343
  19.03.21 18:51:30 ColService 3D20 0 ABLAUF Uploading 1 trace files from device number 50... :13595671
  19.03.21 15:08:41 AUTSTART01 2678 0 MEMORY Actual memory usage:
   Process              ( PID) Workingset Pagefile Starttime           Priority Commandline
   WmiPrvSE             (080C)   9028 KB   2344 KB                               
   WmiPrvSE             (0E98)  16612 KB   7248 KB                               
   WtsCP                (2388)  42800 KB  24396 KB 2021.03.19 15:06:58 Normal   &quot;C:\Program Files (x86)\XXXXXXXXXX\Misc\WTSCP.EXE&quot; 
   WtsCP                (2988)  48052 KB  26444 KB 2021.03.19 15:07:19 Normal   WtsCp.exe 
   ZapService           (0AD0)  19400 KB  25708 KB                               
   :227156
  19.03.21 15:08:41 AUTSTART01 2678 0 INFO:  PlistThread finished :227156
  19.03.21 15:08:41 QW01       27C0 0 DB:    Database encryption for CENTRAL is enabled. :227203
  19.03.21 15:08:42 QW01       27C0 0 DB:    Download: MVKARTEDATEN (BULK Size: 1000) :227296
  19.03.21 15:08:43 AF188      3664 0 SR:    Barrier Motor Info:  state is down 0° / livetime 646-16:31:54  67176 cycles / 32°C Input 233951mV 50251mHz / DC Link Voltage 394 internalSupply 14115mV PhaseU 0mA PhaseW 0mA Restarts 0 :228796
  19.03.21 15:08:44 EF178      3750 0 SR:    Barrier Motor Info:  state is down 0° / livetime 647-15:40:59  7927 cycles / 27°C Input 231829mV 50251mHz / DC Link Voltage 320 internalSupply 14039mV PhaseU 0mA PhaseW 0mA Restarts 0 :229593
  19.03.21 15:08:44 EF26       362C 0 INFO:  RestartInfo: RestartReason = 04, EMReason FE, RunningSince = 2-03:20:09, RequestedCount = 1 :229953
  19.03.21 15:08:44 QW01       27C0 0 DB:     7735 Records copied ! :230078
  19.03.21 15:08:44 QW01       27C0 0 DB:    Download: MVKARTEDATENSERIENNR (BULK Size: 1000) :230078
  19.03.21 15:08:45 AF45       35B4 0 INFO:  RestartInfo: RestartReason = 04, EMReason FE, RunningSince = 2-03:20:14, RequestedCount = 1 :230656
  19.03.21 15:09:17 MENU09      CCC 0 !!!:   Warning: w_mailbox.wf_openchannelex4 get possibly wrong hostname (0506113-09) from GetHostComputerName. Replace with current computername: 0506113-01 :262265
  19.03.21 15:09:17 MENU09      CCC 0 MAIN:  OperatingSystemVersion: Windows Server 2012 (602) :262328
  19.03.21 15:09:17 MENU09      CCC 0 MAIN:  Microsoft SQL Server 2016 (SP2-CU12) (KB4536648) - 13.0.5698.0 (X64) 
      Feb 15 2020 01:47:30 
      Copyright (c) Microsoft Corporation
      Standard Edition (64-bit) on Windows Server 2016 Standard 10.0 &lt;X64&gt; (Build 14393: ) :262328
  19.03.21 15:09:17 MENU09      CCC 0 MAIN:  SQL @@LANGUAGE: us_english :262343
  </code></pre>
  <p><strong>What values I want to be able to get out of it eventually</strong></p>
  <pre class="lang-none prettyprint-override"><code>[1] datetimeValue = 19.03.21 18:45:48
  [2] processShortName = EF22, AUTSTART01, QW01, etc. (max 10 characters)
  [3] threadID = 37D8 (Heximal)
  [4] traceLevel = 1-8 (1 digit)
  [5] tracedProcess = TIMEST, INFO, DB, MAIN (max 6 characters)
  [6] text = &lt;everything between [tracedProcess] and : (at the end of the line)&gt; (this can sometime be spread over multiple lines)
  [7] msTimestamp = the value after the last : (ms since start of trace process)
  </code></pre>
  <p>Now I do it with <code>Substring()</code>and <code>Split()</code> but of course I do not get everything filtered the way I want, only the happy flow when everything is on one line, not when it is spread over several lines.</p>
  <p>How can I do this?</p>