$re = '/^<HOST>.*POST .*.(*wp-login\.php|*xmlrpc\.php).*.(403|499)*/';
$str = '06/Oct/2016:18:44:29 +0200 191.96.249.53 - - mydomain.com "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)" "-"
06/Oct/2016:18:44:29 +0200 191.96.249.53 - - mydomain.com "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)" "-"
06/Oct/2016:18:44:29 +0200 191.96.249.53 - - mydomain.com "POST /xmlrpc.php HTTP/1.0" 499 0 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)" "-"';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php