import re

pattern = re.compile(r'(?:port (\d+))|(?:Logon ID:\s+(\w+)\s+Logon)')

s = '''
2019-07-09 14:39:36,592 - /Volumes/unix/workplace/Inprogress/AMSReplaceBastions_test.py[line:93] - INFO: [Security] [4634] [Microsoft-Windows-Security-Auditing] [WIN] [An account was logged off.

Subject:
Security ID: S-1-5-21-2699825732-1888650521-3855454274-2782
Account Name: administartor
Account Domain: test
Logon ID: 0x6800CD4

Logon Type: 10

Starting session: shell on pts/0 for root from 10.0.0.70 port 45912 id 0
'''

print(pattern.findall(s))