$re = '/(?<x_client_ip>.*?)\t-\t-\t.*?\t(?<http_status>.*?)\t(?<content_length>.*?)\t(?<referer>.*?)\t(?<user_agent>.*?)\t(?<method>.*?)\t(?<uri>.*?)\t(?<query_string>.*?)\t(?<protocol>.*?)\t(?<duration>.*?)\t-\t-\t-\t(?<id>.*)\t(?<client_ip>\d+\.\d+\.\d+\.\d+)\t/';
$str = '111.111.11.11 - - [17/Mar/2017:05:49:45 -0400] 302 231 "https://test.test.com/test/test/viewTest" "Mozilla/5.0 (Windows NT 10.0; WOW64) webWebKit/537.36 (KHTML, like Gecko) Web/56.0.2924.87 Safari/537.36" GET "/favicon.ico" "" HTTP/1.1 5236 - - - RES58cbb1390a02287220001fc146464dds 111.211.111.111 ';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php