$re = '/m!\A[][:\p{Ll}\p{Lu}\p{Zs}\p{Nd}]\[error\][][.\p{Ll}\p{Zs}\p{Nd}]ModSecurity:[]MS_[".\/\p{Ll}\p{Zs}\p{Nd}-]\[id "9990229"\][]MS_[".\/\p{Ll}\p{Zs}\p{Nd}-]$!mg) {
}
/';
$str = '[Tue Nov 04 20:49:49 2014] [error] [client 72.253.126.112] ModSecurity: [file "/etc/httpd/modsecurity-crs/custom_Mod_Security_rules/srb_block_login_attempts.conf"] [line "11"] [id "9990229"] [msg "Bad url - blogs"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "/blogs/" at REQUEST_URI. [hostname "mauicom.com"] [uri "/blogs/"] [unique_id "VFnIjUj9fm8AAI64MP4AAAAG"]
';
$subst = "";
$result = preg_replace($re, $subst, $str, 1);
echo "The result of the substitution is ".$result;
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php