$re = '/^(?<timestamp>[^ ]*)\.(?<time_microseconds>\d*)\+[^ ]+ (?<host>[^ ]*) postgres\[(?<pid>\d*)\]: \[(?<groupid>[^ ]\d*)-(?<lineid>[^ ]\d*)\](?<message>.*)$/m';
$str = '2017-03-21T03:01:32.627434+00:00 ec317 postgres[82271]: [134-1] 2017-03-21 03:01:32 UTC [82271]: [2-1] user=unknown db=[unknown] LOG: incomplete startup packet
2017-03-21T03:01:32.761669+00:00 ec317 postgres[82270]: [135-1] 2017-03-21 03:01:32 UTC [82270]: [3-1] user=gz_kettle,db=greenzone LOG: disconnection: session time: 0:00:00.182 user=gz_kettle database=greenzone host=172.26.27.22 port=35849
2017-03-21T03:01:32.800403+00:00 ec317 postgres[82272]: [133-1] 2017-03-21 03:01:32 UTC [82272]: [1-1] user=[unknown],db=[unknown] LOG: connection received: host=172.26.27.22 port=35850
2017-03-21T03:01:32.801596+00:00 ec317 postgres[82272]: [134-1] 2017-03-21 03:01:32 UTC [82272]: [2-1] user=gz_kettle,db=greenzone LOG: connection authorized: user=gz_kettle database=greenzone';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php