const regex = /^(.+)([A-Z]{3}:)(\s+)([A-Z0-9|=]+)(.*\S\s*?)/gm;
// Alternative syntax using RegExp constructor
// const regex = new RegExp('^(.+)([A-Z]{3}:)(\\s+)([A-Z0-9|=]+)(.*\\S\\s*?)', 'gm')
const str = `2019-05-08T20:55:04.913701+00:00 CEF: 0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
CEF:0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
`;
const subst = `\2\4\5`;
// The substituted value will be contained in the result variable
const result = str.replace(regex, subst);
console.log('Substitution result: ', result);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for JavaScript, please visit: https://developer.mozilla.org/en/docs/Web/JavaScript/Guide/Regular_Expressions