$re = '/\"vpn_ip\":\s+\"(?<vpn_ip>\d+\.\d+\.\d+\.\d+)/m';
$str = '2023-06-21T03:29:16+0000 [stdout#info] LOG ERR: \'LOG_DB RECORD {"username": "duocnv", "common_name": "duocnv", "start_time": 1687312988, "session_id": "aa2d4wW6GaPydjA4", "service": "VPN", "proto": "UDP", "port": "1194", "active": 1, "auth": 1, "version": "3.6.7", "gui_version": "OCmacOS_3.4.2-4547", "platform": "mac", "bytes_in": 1448266, "bytes_out": 15124146, "bytes_total": 16572412, "vpn_ip": "172.27.20.2", "duration": 5168, "node": "ip-10-250-101-154.ap-southeast-1.compute.internal", "timestamp": 1687318156}\'';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php