$re = '/^\s*
# date
(?<date>\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2})
# facility.severity
\s(?<facility>\S+)\.(?<severity>\S+)
# server
\s(?<server>\S*)
# date
\s(?<otherDate>\d{4}-\d{2}-\d{2}:\s\d{2}:\d{2}:\d{2})
# time zone
\s(?<timeZone>\S*)
# ip address
\s(?<ip>\S*)
# legacy email address
\s(?<legacyEmailAddress>\S*)
# first name
\s(?|"(?<firstName>[^"\n]+)"|(?<firstName>\S*))
# last name
\s(?|"(?<lastName>[^"\n]+)"|(?<lastName>\S*))
# account number
\s(?<account>\S*)
# program code
\s(?<programCode>\S*)
# uid
\s(?<uid>\S*)
# email address
\s(?<emailAddress>\S*)
# event type
\s(?<eventType>\S*)
# source
\s(?<source>\S*)
# category
\s(?<category>\S*)
\s*$/mx';
$str = '2016-01-29 18:19:54 local1.info server.domain.com 2016-01-29: 11:19:54 MST UNKNOWN UNKNOWN FOO "BAR BAZ" UNKNOWN UNKNOWN UNKNOWN EMAIL@EXAMPLE.COM PROFILE_CHANGE ProfileChangeProcessor A
2016-01-29 18:20:25 local4.info server.domain.com 2016-01-29: 11:20:25 MST UNKNOWN UNKNOWN "F B" BAZ ABC12345 GP SOME_UID EMAIL@EXAMPLE.COM EVENT_FROM_SOME_PROCESS UNKNOWN UNKNOWN
2016-01-29 18:23:10 local1.info server.domain.com 2016-01-29: 11:23:10 MST UNKNOWN UNKNOWN FOO BAR UNKNOWN UNKNOWN UNKNOWN EMAIL@EXAMPLE.COM SOME_CHANGE ProfileChangeProcessor AP
2016-01-29 18:26:24 local1.info server.domain.com 2016-01-29: 11:26:24 MST UNKNOWN EMAIL@EXAMPLE.COM FOO "B\'Baz" UNKNOWN UNKNOWN UNKNOWN SOME_CHANGE ProfileChangeProcessor O
2016-01-29 18:26:55 local1.info server.domain.com 2016-01-29: 11:26:55 MST UNKNOWN EMAIL@EXAMPLE.COM "FOO OR BAR" BAZ SXR12646 GP UNKNOWN SOME_CHANGE ProfileChangeProcessor M';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php