REGEX match on multiple conditions help

[roguepacket]

I need help with a REGEX that needs to match multiple conditions in a log event.

The event looks like this:

02:02:02.000 AM 
Mar 30 02:02:02 servername1 Oracle Audit[2225]: SESSIONID: "123456789" ENTRYID: "*****" USERID: "ABC" USERHOST: "server2"  OBJ$CREATOR: "LMN" OBJ$NAME: "value1" SES$ACTIONS: "--**********-" OS$USERID: "someusername" 

I need to send events to the nullQueue when all of the following conditions are met:

1. USERHOST: "server2"
2. OS$USERID: "someusername"
3. USERID: "ABC"

This is the REGEX that I have in place, but doesn't seem to be working:

REGEX = (?s)(OS\$USERID:\s.someusername.).+?(USERHOST:\s.server2.).+?(USERID:\s.ABC.)

Any ideas on how to correct my failing regex?
THanks

[Ayn · Accepted solution]

Well since you put the "OS$USERID" match first of all in regex, but it's the last part of the event you're matching against, the whole regex will fail. You need to put the matching groups in the correct order. In your event, USERID comes first, followed by USERHOST and OS$USERID. So, something like this should work:

REGEX = (?s)(USERID:\s.ABC.).+?(USERHOST:\s.server2.).+?(OS\$USERID:\s.someusername.)

[the_wolverine]

What is the purpose of (?s)

The regex did not work for me when I used it. Works fine without it (for me).

[landen99]

"?" changes the "+" from greedy to lazy. Lazy means match as few as possible. Greedy means match as many as possible.

[roguepacket]

Worked perfectly! Thanks for your quick answer!