$re = '/.*ad.srccountry=(?<cs1>.*?)\s.*$/';
$str = '0|Fortinet|FortiGate-600E|3.2.1,build1204 (DA)|1239233|app-ctrl utm pass|4|start=Mar 06 2022 23:10:08 logver=232123123 deviceExternalId=FGBHAAAAAA1 dvchost=production01 ad.vd=prod01 ad.eventtime=1646604609212138288 ad.tz=+0100 ad.logid=0000000013 cat=traffic ad.subtype=forward deviceSeverity=notice src=10.0.0.2 spt=37628 deviceInboundInterface=Dev LAN ad.srcintfrole=lan dst=70.70.70.2 dpt=443 deviceOutboundInterface=VL-Develop1 ad.dstintfrole=undefined ad.srccountry=Norway ad.dstcountry=Denmark externalID=10999383 proto=6 act=close ad.policyid=67 ad.policytype=policy ad.poluuid=dca6b9de-adc11-51e2-d100-3cc871c8edae ad.policyname=prod01 to Internet app=HTTPS ad.trandisp=noop ad.duration=1 out=1446 in=4377 ad.sentpkt=11 ad.rcvdpkt=12 ad.shapingpolicyid=1 ad.shapersentname=Production-01 ad.shaperdropsentbyte=0 ad.shaperrcvdname=Filter-WAN ad.shaperdroprcvdbyte=0 ad.appcat=unscanned ad.mastersrcmac=a1:a1:a1:a1:a1:a1 ad.srcmac=a1:a1:a1:a1:a1:a1 ad.srcserver=0 tz="+0100"';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php