$re = '/^(?<time>[^ +][-:0-9TZ]+|[[:upper:]][[:lower:]]{2}[ -:+0-9TZ]*)([^ ][+0:]+|\s+)(\s*)(?<host>[^ ][-\w\d]+)(\s*)(?<service>[^ [][-_\w]+)(\[(?<pid>[^ \]][\d]*)\]):\s*((\[\s*(?<mtime>[^ ][\w: \/]+)\]\s*\[\s*(?<severity>[^ ][\w]+)\]\s*){0,1}\s*\[\s*(?<component>[^ ][\w:]+)\]){0,1}\s*(?<message>.*){0,1}.*$/xm';
$str = 'Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3915] haproxy: [1503580119.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:08:39", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3916] haproxy: [1503580148.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:08", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3917] haproxy: [1503580151.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:11", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3918] haproxy: [1503580164.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:24", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"message re
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3919] haproxy: [1503580167.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:27", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:56:47 ctl01 td-agent-bit[22911]: [3920] haproxy: [1503580172.000000000, {"path"=>"/var/log/sapmock/haproxy.log", "time"=>"2017-08-24T13:09:32", "host"=>"de4-1d-2d-0d-44-a0", "service"=>"ceilometer-polling", "message"=>"AMQP serve
Oct 02 12:58:52 ctl01 td-agent-bit[22911]: [engine] caught signal
Oct 02 12:58:52 ctl01 td-agent-bit[22911]: [2017/10/02 12:58:52] [ info] [input] pausing tail.0
Oct 02 12:58:52 ctl01 td-agent-bit[22911]: [2017/10/02 12:58:52] [ info] [input] pausing tail.1
Oct 02 12:58:52 ctl01 systemd[1]: Stopping TD Agent Bit...
Oct 02 13:00:22 ctl01 systemd[1]: td-agent-bit.service: State \'stop-sigterm\' timed out. Killing.
Oct 02 13:00:22 ctl01 systemd[1]: td-agent-bit.service: Main process exited, code=killed, status=9/KILL
Oct 02 13:00:22 ctl01 systemd[1]: Stopped TD Agent Bit.
Oct 02 13:00:22 ctl01 systemd[1]: td-agent-bit.service: Unit entered failed state.
Oct 02 13:00:22 ctl01 systemd[1]: td-agent-bit.service: Failed with result \'signal\'.
Oct 02 13:00:22 ctl01 systemd[1]: Started TD Agent Bit.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [ info] [engine] started
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [in_tail] parser \'rabbitmq\' is not registered
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [ warn] [out_es] consider use a tag_key that starts with \'_\'
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
Oct 02 13:00:22 ctl01 td-agent-bit[23506]: [2017/10/02 13:00:22] [error] [parser:haproxy] Invalid time format %Y-%m-%dT%H:%M:%S.
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php