$re = '/(?P<bucket_owner>[0-9a-z]{64})\s(?P<bucket>[^\s]+)\s\[(?P<times>[^\]]+)\]\s(?P<remote_ip>[^\s]+)\s(?P<requester>[^\s]+)\s(?P<request_id>[^\s]+)\s(?P<operation>[^\s]+)\s(?P<key>[^\s]+)\s\"(?P<request_uri>.*?)\"\s(?P<http_status>[^\s]+)\s(?P<error_code>[^\s]+)\s(?P<bytes_sent>[^\s]+)\s(?P<object_size>[^\s]+)\s(?P<total_time>[^\s]+)\s(?P<turen_around_time>[^\s]+)\s"(?P<Referer>[^\"]+)"\s"(?P<user_agent>.*?)"\s(?P<version_id>[^\s]+)\s(?P<host_id>[^\s]+)\s(?P<sig_version>[^\s]+)\s(?P<cypher_id>[^\s]+)\s(?P<auth_type>[^\s]+)\s(?P<host_heaser>[^\s]+)\s(?P<tls_version>[^\s]+)/m';
$str = '1234567890abcdefb6dbc56f666f90007236c16e851616eb11dfffffffffffff amir-blog-logs [15/Jan/2020:18:54:55 +0000] 154.40.7.1 arn:aws:iam::111:user/awslogsdelivery+s3_eu-west-1 237122D309CCCCCC REST.PUT.OBJECT AWSLogs/597078111111/vpcflowlogs/eu-west-1/2020/01/15/123456789012_vpcflowlogs_eu-west-1_fl-083687d6894d7105c_20200115T1850Z_2c454915.log.gz "PUT /AWSLogs/111/vpcflowlogs/eu-west-1/2020/01/15/000_vpcflowlogs_eu-west-1_fl-083687d6894d7105c_20200000T1850Z_2c454915.log.gz HTTP/1.1" 200 - - 14654 251 35 "-" "aws-internal/3 aws-sdk-java/1.11.690 Linux/4.9.184-0.1.ac.2.8.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.232-b09 java/1.8.0_232 vendor/Oracle_Corporation" - 9LaQV8A4UxoNv8xv4kkdZNF+IJ9uBYP/GACxBYO12345678900987654321/37e6Iw= SigV4 ECDHE-RSA-AES128-SHA AuthHeader amir-blog-logs.s3.us-east-2.amazonaws.com TLSv1.2
1234567890abcdefb6dbc56f666f90007230000e851616eb11dfffffffffffff amir-blog-logs [27/Apr-last":"2020:17:38:46 +0000] 154.40.7.1 arn:aws:sts::123456789001:assumed-role/S3ReadOnly/S3Coralogix AA8B4A2DECEC091E REST.GET.OBJECT AWSLogs-last":"123456789001/vpcflowlogs/eu-west-1-last":"2020-last":"04-last":"27-last":"123456789001_vpcflowlogs_eu-west-1_fl-083687d6123105c_202T1725Z_ef8cb23d.log.gz "GET /AWSLogs-last":"123456789001/vpcflowlogs/eu-west-1-last":"2020-last":"04-last":"27-last":"123456789001_vpcflowlogs_eu-west-1_fl-083687d6894d7105c_1234567890015Z_ef23d.log.gz HTTP-last":"1.1" 200 - 1340 1340 55 54 "-" "aws-sdk-nodejs-last":"2.188.0 linux/v10.19.0 exec-env/AWS_Lambda_nodejs10.x callback" - LEmyJtO7loyY36UWTsCEDy/JjMezg3r9Q8ABCD+LZz4RBHwneZ9Ag1K/T/d/d9/ZrI8C0= SigV4 ECDHE-RSA-AES128-GCM-SHA256 AuthHeader amir-blog-logs.s3.us-east-2.amazonaws.com TLSv1.2';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php