$re = '/\n\s\sname:\sI_LOGON_AUTH_FAILED\n[\s\S]*?\s\ssession\n[\s\S]*?\s\s\s\sremoteAddress:\s(?<ipaddress>.*?):[0-9]*\n[\s\S]*?\s\sauthentication\n[\s\S]*?\s\s\s\suserName:\s(?<username>.*)/i';
$str = 'event
time: 2021-11-23 22:42:59.164039 +0300
app: BvSshServer 8.49
name: I_LOGON_AUTH_FAILED
desc: User authentication failed.
session
id: 1015
service: SSH
remoteAddress: 192.168.0.103:41104
authentication
attemptNr: 1
serialize: completion
userName: userTest
method: keyboard-interactive
submethod: Password
windowsAccount: DESKTOP-FN3LTFE\\paprikar
parameters
failureReason: BadCredentials
help
message: Unknown user name or incorrect password.
';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php