Zabbix 5.4.4 Data preprocessing, would like just usernames and connection type

[josh.baker]

Greetings

Here is the scenario I would like to accomplish

I am running the command through the agent on a host to generate an item. the item is system.run[query user |findstr /R "Active"]

The output comes out like this

(Username redacted) rdp-tcp#1 8 Active none 4/20/2021 8:37 AM
(Username redacted) rdp-tcp#2 9 Active none 4/20/2021 10:21 AM
... Continues for other users connected

I would like to reduce this output down to just the username and the session type (rdp-tcp). Active is assumed and not needed along with the date/time, what ever none is can leave also.

So far, preprocessing with regex I have only been able to return just the first user name if using something like \b[^\d\W]+\b inside of regular expression pattern field and output \0 or \1(don't remember exactly)
Using the matches regular expression returns all characters on all lines(very weird)

Thanks for the help

[josh.baker]

Ok great, now I know I need to use java for what I am trying to accomplish. That puts me down a bigger rabbit hole so to speak as I am no java programmer. (I tried using some examples online but it seems I am stuck even on first line error)

It looks as if I am stuck for now.

[cyber]

your item has multiline value, if you apply regex on it, it will return first value only. It is pretty understandable, as regex is not transforming whole that text into something other...you need JS preprocessing for that.
"matching regular expression" correctly returns whole value, as there is that kind of regex present.