$re = '/(?<=url=tcp://)[1-9][0-9]?\.tcp\.(?:ap|au|eu|in|jp|sa|us)\.ngrok\.io:[1-9][0-9]{4}\b/m';
$str = 't=2023-07-05T16:17:15+0300 lvl=info msg="no configuration paths supplied"
t=2023-07-05T16:17:15+0300 lvl=info msg="using configuration at default config path" path=C:\\\\Users\\\\***\\\\AppData\\\\Local/ngrok/ngrok.yml
t=2023-07-05T16:17:15+0300 lvl=info msg="open config file" path=C:\\\\Users\\\\***\\\\AppData\\\\Local\\\\ngrok\\\\ngrok.yml err=nil
t=2023-07-05T16:17:15+0300 lvl=info msg="starting web service" obj=web addr=127.0.0.1:4040 allow_hosts=[]
t=2023-07-05T16:17:15+0300 lvl=info msg="tunnel session started" obj=tunnels.session
t=2023-07-05T16:17:15+0300 lvl=info msg="client session established" obj=csess
t=2023-07-05T16:17:15+0300 lvl=info msg="started tunnel" obj=tunnels name=command_line addr=//localhost:8865 url=tcp://4.tcp.eu.ngrok.io:10355
t=2023-07-05T16:17:16+0300 lvl=info msg="update available" obj=updater';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php