$re = '/(?:(?<reported_hostname>\S+)\:\s)?(?:(?<event_id>\d+)\:\s)?(?:(?<event_id2>\d+)\:\s)?(?<reliable_time>[\.\*])?(?<device_time>.+):\s%(?<iosxe>IOSXE)-6-(?<platform>PLATFORM):(?:\s\w+\d:\s)?(?<proccess_name>\S+): QFP:(?<qfp>\d+.\d+) Thread:(?<thread>\d+) TS:(?<ts>\d+) %(?<facility>[A-Z0-9_]+)-((?<subfacility>[A-Z0-2_]*(-?[A-Z_][^-]*))-?)?(?<severity_id>[0-7])-(?<mnemonic>[A-Z0-9_]+):\s?(?<message_text>.+)
/m';
$str = 'May 7 10:10:10 10.10.0.154 61: AP:7cad.7428.3ddb: *May 7 17:10:10.731: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to down
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php