$re = '/(\d{4})-((0[1-9])|(1[0-2]))-(0[1-9]|[12][0-9]|3[01])\ (?:[0-1]?[0-9]|[2][1-4]):[0-5]?[0-9]:[0-5]?[0-9]/m';
$str = '[fw4_allow] []start_time="2018-11-20 16:17:47" end_time="2018-11-20 16:17:47" duration=0 machine_name=Single_FW_M fw_rule_id=5 nat_rule_id=- src_ip=172.16.11.59 userid= src_port=56392 dst_ip=112.107.220.32 dst_port=80 protocol=TCP ingres_if=EXT input interface=eth0 packets_forward=1 packets_backward=0 bytes_forward=64 bytes_backward=0 fragment_info= flag_record=Invalid / FIN1 [AF:-] terminate_reason=TCP Session Install';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php