$re = '/ssh\s\|\s(?<FIELD_NAME>\S+)/m';
$str = 'event 1:
31.138.204.1 | ssh | o*1N0HIQQx434x12481145x1 | ZI53713 | 2018-05-28 07:14:47,848 | SSH - piv-receive-pack \'/hvq849/spcp-mdo-scoring.git\' | - | 0 | 15122 | 738 | push, ssh:user:id:121237 | 1595 | 10togc8 |
event 2:
31.138.204.1 | ssh | i*1N0HIQQx434x12481145x1 | ZI53713 | 2018-05-28 07:14:47,848 | SSH - piv-receive-pack \'/hvq849/spcp-mdo-scoring.git\' | - | 0 | 15122 | 738 | push, ssh:user:id:121237 | 1595 | 10togc8 |
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php