$re = '/"repoType":(.*?)"repo":(.*?),|"resType":(.*?),|"result":(.*?),|"policy":(.*?),|"enforcer":(.*?),|"sess":(.*?),|"cliType":(.*?),|"reqData":(.*?),|"agentHost":(.*?),|"logType":(.*?),|"id":(.*?),|"seq_num":(.*?),|"event_count":(.*?),|"event_dur_ms":(.*?),|"tags":(.*?),|"additional_info":|"{(.)(?!$)/m';
$str = '{"repoType":3,"repo":"DEV01_hive","reqUser":"na230292","evtTime":"2018-05-07 07:29:16.765","access":"ALTER","resource":"stg_hr_erp_hr_erpprod/hr_dm_application_groups","resType":"@table","action":"alter","result":1,"policy":695,"enforcer":"ranger-acl","sess":"ce536988-846d-47d2-a9dc-40e88c9c3e1a","cliType":"HIVESERVER2","cliIP":"149.25.76.150","reqData":"msck repair table stg_hr_erp_hr_erpprod.hr_dm_application_groups","agentHost":"rpc11743.corp.ncr.com","logType":"RangerAudit","id":"358f75d9-8423-49e1-bd3e-3cc795cccf2e-25620","seq_num":51241,"event_count":1,"event_dur_ms":0,"tags":[blah],"additional_info":"{\\"remote-ip-address\\":149.25.76.150, \\"forwarded-ip-addresses\\":[]","cluster_name":"DEV01"}
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php