This regular expression suits you:
.*:\s+(.*)\s+LOGIN.*
The desired ROOT will be in the first group of matches.
PS That regular expression that is written in your question does not make sense at all.
Here is how it might look in code (it should work the same in both the 4th and 5th versions)
QString source{"<85>login[2775]: ROOT LOGIN on '/dev/tty1'"}; QRegExp regexp{R"-(.*:\s+(.*)\s+LOGIN.*)-"}; if(regexp.exactMatch(source)) qDebug() << "The found login is: " << regexp.cap(1);
Solution for Qt5 exclusively, with a slightly more efficient regular expression:
QString source{"<85>login[2775]: ROOT LOGIN on '/dev/tty1'"}; QRegularExpression regexp{R"-(.*?:\s+(.*?)\s+LOGIN.*)-"}; QRegularExpressionMatch match = regexp.match(source); if(match.hasMatch()) qDebug() << "The found login is: " << match.captured(1);