import re
 
pattern = re.compile(r'(?:port (\d+))|(?:Logon ID:\s+(\w+)\s+Logon)')
 
s = '''
2019-07-09 14:39:36,592 - /Volumes/unix/workplace/Inprogress/AMSReplaceBastions_test.py[line:93] - INFO: [Security] [4634] [Microsoft-Windows-Security-Auditing] [WIN] [An account was logged off.
 
Subject:
Security ID: S-1-5-21-2699825732-1888650521-3855454274-2782
Account Name: administartor
Account Domain: test
Logon ID: 0x6800CD4
 
Logon Type: 10
 
Starting session: shell on pts/0 for root from 10.0.0.70 port 45912 id 0
'''
 
print(pattern.findall(s))
 
 

aW1wb3J0IHJlCgpwYXR0ZXJuID0gcmUuY29tcGlsZShyJyg/OnBvcnQgKFxkKykpfCg/OkxvZ29uIElEOlxzKyhcdyspXHMrTG9nb24pJykKCnMgPSAnJycKMjAxOS0wNy0wOSAxNDozOTozNiw1OTIgLSAvVm9sdW1lcy91bml4L3dvcmtwbGFjZS9JbnByb2dyZXNzL0FNU1JlcGxhY2VCYXN0aW9uc190ZXN0LnB5W2xpbmU6OTNdIC0gSU5GTzogW1NlY3VyaXR5XSBbNDYzNF0gW01pY3Jvc29mdC1XaW5kb3dzLVNlY3VyaXR5LUF1ZGl0aW5nXSBbV0lOXSBbQW4gYWNjb3VudCB3YXMgbG9nZ2VkIG9mZi4KClN1YmplY3Q6ClNlY3VyaXR5IElEOiBTLTEtNS0yMS0yNjk5ODI1NzMyLTE4ODg2NTA1MjEtMzg1NTQ1NDI3NC0yNzgyCkFjY291bnQgTmFtZTogYWRtaW5pc3RhcnRvcgpBY2NvdW50IERvbWFpbjogdGVzdApMb2dvbiBJRDogMHg2ODAwQ0Q0CgpMb2dvbiBUeXBlOiAxMAoKU3RhcnRpbmcgc2Vzc2lvbjogc2hlbGwgb24gcHRzLzAgZm9yIHJvb3QgZnJvbSAxMC4wLjAuNzAgcG9ydCA0NTkxMiBpZCAwCicnJwoKcHJpbnQocGF0dGVybi5maW5kYWxsKHMpKQoK