For this use case see the message below we like to extract is . I can extract this 1st part ok but can not extract the 2nd part Needed information from Event ID message: Ist part --Header--- --Data Results -- Account Name: test01 New Process Name: C:\Program Files\WinZip\Utils ComputerName= server001 2nd Part This is the only information we need from the multi line error message Client IP address: 10.10.00.10:34567 Identity the client attempted to authenticate as: Test\SVC_testLDAP =================================== See Event ID error below as an example: LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4888 EventType=0 Type=Information ComputerName= server001 TaskCategory=Process Creation OpCode=Info RecordNumber=934605653 Keywords=Audit Success Message=A new process has been created. Creator Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: test01 Account Domain: Test Logon ID: 12345test Target Subject: Security ID: NULL SID Account Name: Test Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2030 New Process Name: C:\Program Files\etc\zip.exe Token Elevation Type: TokenElevationTypeDefault (1) Creator Process ID: 0ss0x Message=The following client performed a SASL (Negotiate/Kerberos/NTLM/Digest) LDAP bind without requesting signing (integrity verification), or performed a simple bind over a clear text (non-SSL/TLS-encrypted) LDAP connection. Client IP address: 10.10.00.10:34567 Identity the client attempted to authenticate as: Test\SVC_testLDAP Binding Type: 3 ... View more