$re = '/^.*?Dropping SNMP request from 10\.57\.0\.42.*to outside.*$|^.*?Source=VLAN1108_10\.57\.98\.(238|239).*Destination=VLAN406_10\.57\.227\.(51|52).*rule_name=NetBackup Access.*$/m';
$str = '<Event xmlns=\'http://schemas.microsoft.com/win/2004/08/events/event\'><System><Provider Name=\'AD FS\' Guid=\'{2ffb687a-1571-4ace-8550-47ab5ccae2bc}\'/><EventID>325</EventID><Version>0</Version><Level>Error</Level><Task>None</Task><Opcode>Info</Opcode><Keywords>AD FS</Keywords><TimeCreated SystemTime=\'2019-06-04T12:20:06.108450100Z\'/><EventRecordID>4031017</EventRecordID><Correlation ActivityID=\'{00000000-0000-0000-2d5d-0080000000cd}\'/><Execution ProcessID=\'3760\' ThreadID=\'6728\'/><Channel>AD FS/Admin</Channel><Computer>GIG06SRVADFS001.cymru.nhs.uk</Computer><Security UserID=\'CYMRU\\GIG_gMSA_ADFS$\'/></System><UserData>The Federation Service could not authorize token issuance for caller \'CYMRU\\Ma047550
\'. The caller is not authorized to request a token for the relying party \'urn:federation:MicrosoftOnline\'. See event 501 with the same Instance ID for caller identity.
Additional Data
Instance ID: 807cd7c3-c574-4703-b8e4-cbf8a7102bca
Relying party: urn:federation:MicrosoftOnline
Exception details:
Microsoft.IdentityServer.Service.IssuancePipeline.CallerAuthorizationException: MSIS5007: The caller authorization failed for caller identity CYMRU\\Ma047550 for relying party trust urn:federation:MicrosoftOnline.
at Microsoft.IdentityModel.Threading.AsyncResult.End(IAsyncResult result)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult.End(IAsyncResult ar)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.EndProcessCore(IAsyncResult ar, String requestAction, String responseAction, String trustNamespace)
User Action
Use the AD FS Management snap-in to ensure that the caller is authorized to request a token for the relying party.</UserData></Event>
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php