$re = '/(?\'gPatSyslogPRI\'<\d+>)
(?\'gPatMesgBody\'.*)
(?\'gPatMesgBodyMin\'.*?)
(?\'gPatSyslogNGHeader\'\w{3}\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(?\'gPatMon\'Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec|\d{1,2})
(?\'gPatMonNum\'\d{1,2})
(?\'gPatDay\'\d{1,2})
(?\'gPatTime\'\d{1,2}:\d{1,2}:\d{1,2})
(?\'gPatYear\'\d{2,4})
(?\'gPatMSec\'\d{1,3})
(?\'gPatTimeMSec\'\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3})
(?\'gPatTimeZone\'Z|UTC|[+-]\d{1,2}:?\d{2})
(?\'gPatWeekday\'Mon|Tue|Wed|Thu|Fri|Sat|Sun)
(?\'gPatIpV4Dot\'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
(?\'gPatIpAddr\'[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4}){1,5}:(?:\d{1,3}(?:\.\d{1,3}){3}|[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4})?)|\d{1,3}(?:\.\d{1,3}){3})
(?\'gPatIpPort\'\d{1,5})
(?\'gPatProto\'ftp|icmp|tcp|udp|http|ip|smb|smtp|snmp|others|FTP|ICMP|UDP|TCP|HTTP|IP|SMB|SMTP|SNMP|OTHERS)
(?\'gPatFqdn\'\w+[.\w+]+)
(?\'gPatWord\'\w+)
(?\'gPatStr\'[^\s]*)
(?\'gPatHostName\'[\w.-]+)
(?\'gPatStrComma\'[^,]*)
(?\'gPatStrLeftParen\'[^\(]*)
(?\'gPatStrRightSB\'[^\]]*)
(?\'gPatInt\'\d+)
(?\'gPatSpace\'\s+)
(?\'gPatStrEndColon\'[^:]*)
(?\'gPatStrSQ\'[^\']*)
(?\'gPatStrDQ\'[^\']*)
(?\'gPatSentence\'\w[\s+\w]*)/m';
$str = '';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php