$re = '%^\s*\S*\w*\W*(?<severity>\w)(?<time>\d{4}\s[^\s]*)\s+(?<pid>\d+)\s+(?<source>[^ \]]+)\](?<message>.*\n)%m';
$str = '{"log":"I1121 14:37:42.883962 1 serve.go:85] Serving securely on 0.0.0.0:6443\\n","stream":"stderr","time":"2017-11-21T14:37:42.902231562Z"}
{"log":"I1121 14:37:42.885062 1 apiservice_controller.go:112] Starting APIServiceRegistrationController\\n","stream":"stderr","time":"2017-11-21T14:37:42.902266652Z"}
{"log":"I1121 14:37:42.885079 1 cache.go:32] Waiting for caches to sync for APIServiceRegistrationController controller\\n","stream":"stderr","time":"2017-11-21T14:37:42.902269685Z"}
{"log":"I1121 14:37:42.886031 1 available_controller.go:192] Starting AvailableConditionController\\n","stream":"stderr","time":"2017-11-21T14:37:42.902271525Z"}
{"log":"I1121 14:37:42.886043 1 cache.go:32] Waiting for caches to sync for AvailableConditionController controller\\n","stream":"stderr","time":"2017-11-21T14:37:42.902273437Z"}
{"log":"E0213 13:30:06.573154 1 cleaner.go:100] Error while attempting to clean CSR "csr-4nzcx": unable to delete CSR \\\\\\"csr-4nzcx\\\\\\": certificatesigningrequests.certificates.k8s.io \\\\\\"csr-4nzcx\\\\\\" is forbidden: User \\\\\\"system:serviceaccount:kube-system:certificate-controller\\\\\\" cannot delete certificatesigningrequests.certificates.k8s.io at the cluster scope\\\\n\\",\\"stream\\":\\"stderr\\",\\"time\\":\\"2018-02-13T13:30:06.575560335Z\\"}"
"log": "I0213 17:07:12.217422 1 trace.go:76] Trace[120533389]: \\"Create /api/v1/namespaces/default/events\\" (started: 2018-02-13 17:07:08.211886864 +0000 UTC m=+8.804410052) (total time: 4.005504088s):\\n",
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php