# If you'd like to omit non-matching lines from the result; add ';d' to the end of the expression.
sed -E 's/^(.+)([A-Z]{3}:)(\s+)([A-Z0-9|=]+)(.*\S\s*?)/\2\4\5/gm;t' <<< "2019-05-08T20:55:04.913701+00:00 CEF: 0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
CEF:0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
"
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for SED, please visit: https://www.gnu.org/software/sed/manual/html_node/The-_0022s_0022-Command.html