$re = '/(?:[\S]+received_bytes_count )(?:true|false) ([\S]+)|(?:[\S]+received_bytes_count )([\S]+) (?:true|false)|(?:[\S]+received_bytes_count )([\S]+)/';
$str = 'compute.googleapis.com/instance/network/received_bytes_count fleetwood false
compute.googleapis.com/instance/network/received_bytes_count false graceland
compute.googleapis.com/instance/network/received_bytes_count false creedence
compute.googleapis.com/instance/network/received_bytes_count false gke-oamstest-default-pool-bcb12758-nvb9
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-nvb9 true
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-6bzw false
compute.googleapis.com/instance/network/received_bytes_count true gke-oamstest-default-pool-bcb12758-6bzw
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-s4td false
compute.googleapis.com/instance/network/received_bytes_count true gke-oamstest-default-pool-bcb12758-s4td
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-nvb9
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-6bzw
compute.googleapis.com/instance/network/received_bytes_count gke-oamstest-default-pool-bcb12758-s4td
';
$subst = "$1$2$3 Rcvd";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php