$re = '/\bdest_ip=(?P<dest_ip>\S+).*?\bdest_port=(?P<dest_port>\S+)/m';
$str = '> Jan 15 15:16:11 10.0.5.9 Jan 15 15:16:11 ff:ff:00:01 nfc_id=20067 exp_ip=10.0.5.25 input_snmp=2 output_snmp=7 protocol=17 src_ip=43.152.96.179 src_host="unknown" src_port=1049 dest_ip=40.169.38.123 dest_host=unknown dest_port=137 tcp_flag=...... packets_in=131 bytes_in=22078 src_tos=0 dest_tos=0 src_asn=65535 dest_asn=65535 flow_count=1 percent_of_total=10.626 flow_smpl_id=2 t_int=30015 =24520
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php