$re = '/^.*?]\s(?<severity>\w+)\s+(?<group>[^\[]+)\[(?<action>\w+)\,\s+.*?name=(?<login>\w+)\,\s+usid=(?<recipient>\w+)\,\s+addr=(?<sip>.*?)\,\s+prot=(?<session>.*?)\]\,\s+db=(?<status>.*?)\]$/m';
$str = '10 23 2018 09:23:59 1.1.1.1 <LOC2:WARN> Oct 23 09:24:00 2018-10-23 09:24:00,076 [Thread-0] WARN EventLHost1d- UserSessNotification[STOP_TRANS, user=[name=admin, usid=72422, addr=127.0.0.1, prot=1], db=DB_RUNNING]
10 22 2018 17:07:48 1.1.4.1 <LOC2:WARN> Oct 22 17:08:00 2018-10-23 03: 08:00,393 [Thread-0] WARN EventLHost1d- AuditNotification[logno=103, user=admin, usid=0, msg="Logged in over ssh using externalauth, member of groups: admin,auditor,manage-appliance,manage-pki,manage-policy"]
10 19 2018 12:36:18 1.1.1.1 <LOC2:WARN> Oct 19 12:36:19 2018-10-19 12: 36:19,112 [Thread-0] WARN EventLHost1d- UserSessNotification[STOP, user=[name=admin, usid=27572, addr=127.0.0.1, prot=1], db=DB_NONE]
10 22 2018 09:36:11 1.1.4.1 <LOC2:WARN> Oct 22 09:36:22 2018-10-22 19: 36:22,691 [Thread-0] WARN EventLHost1d- AuditNotification[logno=107, user=admin, usid=32891, msg="Logged out from maapi ctx=webui (closed)"]
10 24 2018 09:31:54 1.1.1.1 <LOC2:ALRT> Oct 24 09:31:55 SSLCDMX Health monitoring: PROBLEM - SSLCDMX Metric: Load Utilization WARNING: Memory load is at 67.46%. - Capacity util=30.31%
10 22 2018 19:30:13 1.1.3.1 <LOC2:WARN> Oct 22 17:31:38 2018-10-22 17: 31:38,947 [Thread-0] WARN EventLHost1d- AuditNotification[logno=105, user=admin, usid=73051, msg="assigned to groups: manage-policy,manage-pki,manage-appliance,auditor,admin"]
10 23 2018 22:46:23 1.2.3.1 <LOC2:ALRT> Oct 24 01:45:01 SSLREYNOSA root: Health Monitoring (cron): Trimmed event history to 30 days.
10 23 2018 10:04:05 1.1.1.1 <LOC2:WARN> Oct 23 10:04:06 2018-10-23 10: 04:06,531 [Thread-0] WARN EventLHost1d- AuditNotification[logno=105, user=Host2ez, usid=72793, msg="assigned to groups: manage-pki"]';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php