re = /((?<syslog_pri>(^\<\d*\>))|(^(?<facility>[^\.]*)\.(?<severity>[^\s]*)))?\s*(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp}) %{SYSLOGHOST:iporhost}(?<messgae>.*)/
str = '<165>
User.Notice 2016-01-02 00:00:33 1.1.66.15 1.1.66.15 02/01/2016 00:00:00 NTP: Synchronization OK.
Local7.Warning 2016-01-02 00:00:43 1.1.5.6 319129: 14w1d: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/21 (780), with name_a FastEthernet3 (1).
'
subst = ''
result = str.gsub(re, subst)
# Print the result of the substitution
puts result
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Ruby, please visit: http://ruby-doc.org/core-2.2.0/Regexp.html