/
(?#regexp & naming based on RFC5424)
^<(?<priority>\d|\d{2}|1[1-8]\d|19[01])>(?<version>\d{1,2})\s
(?<timestamp>-|(?<fullyear>[12]\d{3})-(?<month>0\d|[1][012])-(?<mday>[012]\d|3[01])T(?<hour>[01]\d|2[0-4]):(?<minute>[0-5]\d):(?<second>[0-5]\d|60)(?#60seconds can be used for leap year!)(?:\.(?<secfrac>\d{1,6}))?(?<numoffset>Z|[+-]\d{2}:\d{2})(?#=timezone))\s
(?<hostname>[\S]{1,255})\s
(?<appname>[\S]{1,48})\s
(?<procid>[\S]{1,128})\s
(?<msgid>[\S]{1,32})\s
(?<structureddata>-|(?:\[.+?(?<!\\)\])+)
(?:\s(?<msg>.+))?$
/
gmx