$re = '/.*?{"EVENT_NAME":"(?<tag6>[^"]*)","EVENT_ID":"(?<action>[^"]*)","User_Id":"(?<login>[^"]*)","X_Corelation_ID":"(?<policy>[^"]*)","Client_IPAddress":"(?<sip>[^"]*)","Acting_As_ID":"(?<account>[^"]*)","Message":"(?<tag2>[^"]*)"}/m';
$str = '[2019-01-15 13:44:43,432] [[ACTIVE] ExecuteThread: \'45\' for queue: \'weblogic.kernel.Default (self-tuning)\'] WARN SiemLogger - {"EVENT_NAME":"SIEM","EVENT_ID":"LOGOUT","User_Id":"ROBKNT1810","X_Corelation_ID":"null","Client_IPAddress":"null","Acting_As_ID":"null","Message":"MobileSignOutPage - User successfully logged out."}
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php