$re = '/^(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? \[(?<time_server>[^\]]*)\] (?<host>[^ ]*) - (?<user>[^ ]*)\\\\"(?<method>\S+)(?: +(?<path>[^\"]*) +\S*)?" (?<code>[^ ]*) (?<size>[^ ]*) \\\\"(?<referer>[^\"]*)\\\\" \\\\"(?<agent>[^\"]*)\\\\"rt=(?<request_time>[^ ]*) uct=\\\\"(?<upstream_connect_time>[^ ]*)\\\\" uht=\\\\"(?<upstream_header_time>[^ ]*)\\\\" urt=\\\\"(?<upstream_response_time>[^ ]*)\\\\" uaddr=\\\\"(?<upstream_addr>[^ ]*)\\\\" x-forwarded-for=\\\\"*(?<http_x_forwarded_for>.*)\\\\"$/';
$str = 'Jun 26 06:53:39 00f628825635[3156]: [26/Jun/2018:06:53:39 +0000] 10.66.44.27 - -\\"GET /health_check HTTP/1.1\\" 200 0 \\"-\\" \\"ELB-HealthChecker/1.0\\"rt=0.000 uct=\\"-\\" uht=\\"-\\" urt=\\"-\\" uaddr=\\"-\\" x-forwarded-for=\\"-\\"';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php