Comment: regexp & naming based on RFC5424
^start of line
<the literal < (6010 / 748 / 3C16)
Group priority(?<priority>\d|\d{2}|1[1-8]\d|19[01]) \d{2}a digit, repeated exactly 2 times
1the literal 1 (4910 / 618 / 3116)
1-8one character from 1 (4910) to 8 (5610)
\da digit
0the literal 0 (4810 / 608 / 3016)
1the literal 1 (4910 / 618 / 3116)
>the literal > (6210 / 768 / 3E16)
Group version(?<version>\d{1,2}) \d{1,2}a digit, repeated between 1 and 2 times
\sany whitespace character
Group timestamp(?<timestamp>-|(?<fullyear>[12]\d{3})-(?<month>0\d|[1][012])-(?<mday>[012]\d|3[01])T(?<hour>[01]\d|2[0-4]):(?<minute>[0-5]\d):(?<second>[0-5]\d|60)(?#60seconds can be used for leap year!)(?:\.(?<secfrac>\d{1,6}))?(?<numoffset>Z|[+-]\d{2}:\d{2})(?#=timezone)) -the literal - (4510 / 558 / 2D16)
2nd Alternative(?<fullyear>[12]\d{3})-(?<month>0\d|[1][012])-(?<mday>[012]\d|3[01])T(?<hour>[01]\d|2[0-4]):(?<minute>[0-5]\d):(?<second>[0-5]\d|60)(?#60seconds can be used for leap year!)(?:\.(?<secfrac>\d{1,6}))?(?<numoffset>Z|[+-]\d{2}:\d{2})(?#=timezone) Group fullyear(?<fullyear>[12]\d{3}) 1the literal 1 (4910 / 618 / 3116)
2the literal 2 (5010 / 628 / 3216)
\d{3}a digit, repeated exactly 3 times
-the literal - (4510 / 558 / 2D16)
Group month(?<month>0\d|[1][012]) 0the literal 0 (4810 / 608 / 3016)
\da digit
1the literal 1 (4910 / 618 / 3116)
0the literal 0 (4810 / 608 / 3016)
1the literal 1 (4910 / 618 / 3116)
2the literal 2 (5010 / 628 / 3216)
-the literal - (4510 / 558 / 2D16)
Group mday(?<mday>[012]\d|3[01]) 0the literal 0 (4810 / 608 / 3016)
1the literal 1 (4910 / 618 / 3116)
2the literal 2 (5010 / 628 / 3216)
\da digit
3the literal 3 (5110 / 638 / 3316)
0the literal 0 (4810 / 608 / 3016)
1the literal 1 (4910 / 618 / 3116)
Tthe literal T (8410 / 1248 / 5416) (case sensitive)
Group hour(?<hour>[01]\d|2[0-4]) :the literal : (5810 / 728 / 3A16)
Group minute(?<minute>[0-5]\d) :the literal : (5810 / 728 / 3A16)
Group second(?<second>[0-5]\d|60) Comment: 60seconds can be used for leap year!
Non-Capturing Group(?:\.(?<secfrac>\d{1,6}))? Group numoffset(?<numoffset>Z|[+-]\d{2}:\d{2}) Comment: =timezone
\sany whitespace character
Group hostname(?<hostname>[\S]{1,255}) \sany whitespace character
Group appname(?<appname>[\S]{1,48}) \sany whitespace character
Group procid(?<procid>[\S]{1,128}) \sany whitespace character
Group msgid(?<msgid>[\S]{1,32}) \sany whitespace character
Group structureddata(?<structureddata>-|(?:\[.+?(?<!\\)\])+) Non-Capturing Group(?:\s(?<msg>.+))? $end of line
g modifier: global. Finds all matches instead of stopping after the first
m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string
x modifier: extended. Ignores unescaped whitespace and comments outside character classes