audit.log

CreateUserEvent, id: 1, username: test, password: test
CreateAccountEvent, id: 1, user_id: 1, balance: 0
CreateUserEvent, id: 2, username: test2, password: test2
CreateAccountEvent, id: 2, user_id: 2, balance: 0
DepositEvent, account_id: 1, amount: 100
DepositEvent, account_id: 2, amount: 100
WithdrawEvent, account_id: 1, amount: 75
WithdrawEvent, account_id: 2, amount: 25

log_parser.rb

require 'parslet'

class LogParser < Parslet::Parser
  rule(:word) { match('[_a-zA-Z0-9]').repeat(1) }

  rule(:space) { match('\s').repeat(1) }
  rule(:space?) { space.maybe }
  rule(:colon) { str(':') >> space? }
  rule(:comma) { str(',') >> space? }
  rule(:comma?) { comma.maybe }

  rule(:event) { word }
  rule(:key) { word }
  rule(:value) { word }
  rule(:pair) { key.as(:key) >> colon >> value.as(:value) >> comma? }
  rule(:line) { event.as(:event) >> comma >> pair.repeat(1) >> any.repeat }

  root(:line)
end

def parse(str)
  parser = LogParser.new
  puts parser.parse(str).inspect
rescue Parslet::ParseFailed => failure
  puts failure.cause.ascii_tree
end

log_file = File.open('audit.log', 'r')
log_file.each do |line|
  parse(line)
end

output.txt

[{:event=>"CreateUserEvent"@0}, {:key=>"id"@17, :value=>"1"@21}, {:key=>"username"@24, :value=>"test"@34}, {:key=>"password"@40, :value=>"test"@50}]
[{:event=>"CreateAccountEvent"@0}, {:key=>"id"@20, :value=>"1"@24}, {:key=>"user_id"@27, :value=>"1"@36}, {:key=>"balance"@39, :value=>"0"@48}]
[{:event=>"CreateUserEvent"@0}, {:key=>"id"@17, :value=>"2"@21}, {:key=>"username"@24, :value=>"test2"@34}, {:key=>"password"@41, :value=>"test2"@51}]
[{:event=>"CreateAccountEvent"@0}, {:key=>"id"@20, :value=>"2"@24}, {:key=>"user_id"@27, :value=>"2"@36}, {:key=>"balance"@39, :value=>"0"@48}]
[{:event=>"DepositEvent"@0}, {:key=>"account_id"@14, :value=>"1"@26}, {:key=>"amount"@29, :value=>"100"@37}]
[{:event=>"DepositEvent"@0}, {:key=>"account_id"@14, :value=>"2"@26}, {:key=>"amount"@29, :value=>"100"@37}]
[{:event=>"WithdrawEvent"@0}, {:key=>"account_id"@15, :value=>"1"@27}, {:key=>"amount"@30, :value=>"75"@38}]
[{:event=>"WithdrawEvent"@0}, {:key=>"account_id"@15, :value=>"2"@27}, {:key=>"amount"@30, :value=>"25"@38}]