#include <MsgBoxConstants.au3> ; to declare the Constants of MsgBox
Local $sRegex = "(?m)^(.+)([A-Z]{3}:)(\s+)([A-Z0-9|=]+)(.*\S\s*?)"
Local $sString = "2019-05-08T20:55:04.913701+00:00 CEF: 0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP " & @CRLF & _
"" & @CRLF & _
"CEF:0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP" & @CRLF & _
""
Local $sSubst = "\2\4\5"
Local $sResult = StringRegExpReplace($sString, $sRegex, $sSubst)
MsgBox($MB_SYSTEMMODAL, "Result", $sResult)
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm