$re = '/^(.+)([A-Z]{3}:)(\s+)([A-Z0-9|=]+)(.*\S\s*?)/m';
$str = '2019-05-08T20:55:04.913701+00:00 CEF: 0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
CEF:0|CISCO|ASA||302013|Built outbound TCP connection|Low| eventId=17363056 externalId=116395008 proto=TCP
';
$subst = "\2\4\5";
$result = preg_replace($re, $subst, $str);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php