This should do the trick:
Interface (?<src_interface>[^,]+), changed state to (administratively )?(?<port_status>\w+)
The '?' after the '(administratively )' capture group, basically tells the regex that the previous group/character is optional.
Used this as my sample data:
Interface 123, changed state to administratively up
Interface 234, changed state to administratively down
Interface 321, changed state to up
Interface 432, changed state to down
It catches all 4 distinct values of "src_interface" and "port_status".
I used regex101 to help double check the regex.
Hope this helps
... View more