$re = '/[\s\'](?:MIMA01|mima01|ERROR\s+Thycotic\.AppCore\.Emailer2|RADIUS|Thycotic\.webapp\.Web\.usercontrols\.Login)[\s\']/m';
$str = '2019-01-07 18:12:50,548 [57] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user gdh failed: Login failed.
2019-01-07 17:39:29,450 [104] ERROR Thycotic.AppCore.Emailer2 (null) - An error occured while sending an email (async internal): to: *redacted* subject: [SecretServer] Password Reset Exception: Value cannot be null.
Parameter name: context
2019-01-07 17:43:49,654 [107] ERROR Thycotic.AppCore.Emailer2 (null) - An error occured while sending an email (async internal): to: *redacted* subject: [SecretServer] Password Reset Exception: Value cannot be null.
Parameter name: context
2019-01-07 17:43:58,123 [107] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user flortx failed: Unable to find a user record from the information provided.
2019-01-07 17:44:30,592 [110] ERROR Thycotic.AppCore.Radius.RadiusAuthenticationProvider (null) - RadiusAuthenticationProvider.Authenticate. Unexpected response code: RadiusCode AccessReject. (Username: flort, Requesting server IP: *redacted*, RADIUS server: 127.0.0.1:1812).
2019-01-07 17:44:30,717 [110] ERROR Thycotic.webapp.Web.usercontrols.Login (null) - Attempt to do a RADIUS Two Factor login failed. Error Message: RADIUS Authentication Failed., ResponseCode: AccessReject, AuditUserError: TWO FACTOR ACCESS REJECTED (Domain: \'Local\', Username: \'flort\', RADIUS Server: \'127.0.0.1:1812\', Machine Name: \'MIMA01\' Is From Access Challenge: False)
2019-01-07 17:44:30,763 [110] WARN Thycotic.webapp.Web.usercontrols.Login (null) - Two-Factor failed. Error:RADIUS Authentication Failed. AuditUserError: TWO FACTOR ACCESS REJECTED Domain: \'Local\', Username: \'flort\', RADIUS Server: \'127.0.0.1:1812\', Machine Name: \'MIMA01\' Is From Access Challenge: False
2019-01-07 17:46:23,982 [87] INFO Thycotic.AppCore.KeepAliveMonitor (null) - Keeping endpoints alive
2019-01-07 22:15:21,727 [98] INFO Thycotic.AppCore.KeepAliveMonitor (null) - Keeping endpoints alive
2019-01-07 22:17:19,196 [63] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user *redacted* failed: Login failed.
2019-01-07 22:20:54,899 [99] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user *redacted* failed: Login failed.
2019-01-07 22:20:58,243 [63] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user *redacted* failed: Login failed.
2019-01-07 22:21:02,024 [10] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user *redacted* failed: Login failed.
2019-01-07 22:21:47,212 [59] INFO Thycotic.webapp.Web.usercontrols.Login (null) - Login attempt on node MIMA01 by user flortx failed: Unable to find a user record from the information provided.
2019-01-07 22:25:21,947 [62] INFO Thycotic.AppCore.KeepAliveMonitor (null) - Endpoint https://127.0.0.1/SecretServer/healthcheck.aspx?selfRun responded healthy in 80ms for 1/7/2019 2:25:21 PM(1/7/2019 10:25:21 PM)
2019-01-07 22:30:21,978 [92] INFO Thycotic.AppCore.KeepAliveMonitor (null) - Keeping endpoints alive
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php