$re = '/.*(?<=GET )([^ ]*).*/m';
$str = '00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri.js?id=123 HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000
00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000
00.00.00.00 - - [23/Mar/2020:16:23:04 +0000] "GET /foo/bar/uri.png HTTP/1.1" 200 19165 "https://nginx.com/foo/bar" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36" "00.00.00.00" 0.000';
$subst = "$1";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php