$re = '/(^\d*.\d*.\d*.\d*) \: (\d*) \-\-.*\|\|(.*)\|\|.*forward\:.*in\:(.*).out\:(.*), src-mac (.*), proto (.*), (\d*.\d*.\d*.\d*\:\d*)\-\>(\d*.\d*.\d*.\d*\:\d*)/m';
$str = '185.123.0.119 : 36733 -- <46>Jan 20 13:35:08 Balkon Cafe ||BALKON_CAFE||: forward: in:Direk_Cikis out:pppoe-out1, src-mac 98:ca:33:d8:5f:8d, proto TCP (ACK,PSH), 192.168.1.36:52071->17.248.147.44:443, NAT (192.168.1.36:52071->185.123.0.119:52071)->17.248.147.44:443, len 341
185.123.0.119 : 36733 -- <46>Jan 20 13:35:08 Balkon Cafe ||BALKON_CAFE||: forward: in:pppoe-out1 out:Direk_Cikis, src-mac 60:73:5c:36:2b:30, proto TCP (ACK,PSH), 17.252.28.30:5223->192.168.1.55:52530, NAT 17.252.28.30:5223->(185.123.0.119:52530->192.168.1.55:52530), len 105
185.123.0.235 : 50416 -- <46>Jan 20 14:34:42 41680773556@46.netcity.net.tr ||enesev||: forward: in:pppoe-41680773556@46.netcity.net.tr out:ether1, src-mac 60:73:5c:36:2b:30, proto TCP (ACK,FIN), 216.58.201.78:443->192.168.1.12:5347, NAT 216.58.201.78:443->(185.123.0.235:5347->192.168.1.12:5347), len 40
185.123.0.235 : 50416 -- <46>Jan 20 14:34:42 41680773556@46.netcity.net.tr ||enesev||: forward: in:ether1 out:pppoe-41680773556@46.netcity.net.tr, src-mac 40:e2:30:ee:7b:c7, proto TCP (ACK), 192.168.1.12:5347->216.58.201.78:443, NAT (192.168.1.12:5347->185.123.0.235:5347)->216.58.201.78:443, len 40
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php