Dec  2 00:14:09 ftp1 ftpd[743]: USER testing1
Dec  2 00:14:09 ftp1 ftpd[743]: FTP LOGIN FROM 192.168.0.2 [192.168.0.2], testing1
Dec  2 00:30:08 ftp1 ftpd[1261]: USER testing1
Dec  2 00:30:09 ftp1 ftpd[1261]: FTP LOGIN FROM 192.168.0.4 [192.168.0.4], testing1
Dec  2 01:12:33 ftp1 ftpd[11804]: USER testing1
Dec  2 01:12:33 ftp1 ftpd[11804]: FTP LOGIN FROM 192.168.0.2 [192.168.0.2], testing1

Dec  1 23:59:03 ftp1 ftpd[4152]: USER testing1
Dec  1 23:59:03 ftp1 ftpd[4152]: PASS password
Dec  1 23:59:03 ftp1 ftpd[4152]: FTP LOGIN FROM 192.168.0.02 [192.168.0.2], testing1
Dec  1 23:59:03 ftp1 ftpd[4152]: PWD
Dec  1 23:59:03 ftp1 ftpd[4152]: CWD /test/data/
Dec  1 23:59:03 ftp1 ftpd[4152]: TYPE Image

$VAR1 = {
      '743' => [
                 '00:1'
               ],
      '20687' => [
                   '01:3'
                 ],
      '27186' => [
                   '15:3'
                 ],
      '6929' => [
                  '12:0'
                ],
      '24771' => [
                   '09:0'
                 ],
      '11804' => [
                   '01:1'
                 ],
      '27683' => [
                   '08:3'
                 ],
      '14976' => [
                   '04:3'
                 ],
};

# -------------------------------------------------------
# Extract PIDs and Time from lines, take out doubles
# -------------------------------------------------------
my $infile3 = 'output.txt';
my %pids;
my $found;
my $var;

open (INPUT2, $infile3) or die "Couldn't read $infile3.n";

while (my $line = <INPUT2>) {
    if($line =~ /(d{2}):(d)/ ) {
        my $hhmm = $1 . ":" . $2;
        if ($line =~ /ftpd[(.*?)]/) {
            $found = 0;
            foreach $var(keys %pids){
                if(grep $1 =~ $var, keys %pids){
                    $found = 1;
                }
            }
            if ($found == 0){
                push @{$pids{$1}}, $hhmm;

            }
        }
    }

}

##-------------------------------------------------------
## read each line from file into an array
##-------------------------------------------------------
open (INPUT, $infile2) or die "Couldn't read $infile2.n";

my @messages;

while (my $line = <INPUT>){
    # if there is a match to the PID then put the line in the array
    if ($line =~ /ftpd[(.*?)]/){
        my $mPID = $1;
        foreach my $key (keys %pids){
            if ($key =~ $mPID){
                push @messages, $line;
            }
        }
    }
}

# -------------------------------------------------------
#find flow based on PID that was found from criteria
#-------------------------------------------------------

foreach my $line(@messages){
    if(my($pid) = $line =~ m{ [ s*(d+) ]: }x) {
        if($line =~ /(d{2}):(d)/){
            my $time = $1 . ":" . $2;
            if ($pids{$pid}[0] =~ /$time/){
                 push $pids{$pid}[0], $line;
            }
        }
    }
}

$VAR1 = {
          '743' => {
                     '' => '00:1'
                   },
          '20687' => {
                       '' => '01:3'
        },

$VAR1 = {
          '743' => '00:1',
          '20687' => '01:3',
};

if($pids{$pid} == qr/$time/){
    $pids{$pid}{$time}[$y] = $line;
    $y++;
};

$VAR1 = {
          '743' => '00:1',
          '4771' => {
                      '23:5' => [
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: USER test
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: PASS password
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: FTP LOGIN FROM 192.168.0.2 [192.168.0.2], test
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: CWD /home/test/
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: TYPE Image
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: PASV
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: RETR test
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: QUIT
',
                                  'Dec  1 23:59:23 ftp1 ftpd[4771]: FTP session closed
'
                                ]
                    },

if($line =~ /(d{2}):(d)/ ) {

if($line =~ /(d{2}):(d{2})/ ) {

if ($line =~ /ftpd[(.*?)]/) {
            $pid{$1}[0] = $hhmm unless exists $pid{$1};
        }

if(grep $1 =~ $var, keys %pids){

my $pid = $1;
        if ($line =~ /ftpd[(.*?)]/) {
            $pid{$pid}{time} = $hhmm unless exists $pid{$pid};
        }
        if ($line =~ /USER (w+)/) {
            $pid{$pid}{user} = $1;
        }

$time{$hhmm}{pid} = $pid;

push @{$user{$1}}, $pid;