$re = '/^(?P<date>\S+\s+\d\s\d\d:\d\d:\d\d) (?P<hostname>\S+) suricata\[(?P<pid>\d+)\]: \[(?P<sid>\d+:\d+:\d+)\] (?P<msg>.+) \[Classification:(?P<classification>.+)\] \[Priority:(?P<priority> \d+)\] \{(?P<proto>.+)\} (?P<src_ip>[\d.]{7,15}):(?P<src_port>\d+) -> (?P<dst_ip>[\d.]{7,15}):(?P<dst_port>\d+)$/';
$str = 'Jun 2 09:56:56 suribox suricata[56928]: [1:2220006:1] SURICATA SMTP no server welcome message [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 1.1.1.1:25 -> 2.2.2.2:28780';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php