$re = '/([a-z_\s]+):(.*)/m';
$str = 'audit_schema_version:1
event_time:2020-01-23 02:04:52.8531183
sequence_number:1
action_id:LGIF
succeeded:false
is_column_permission:false
session_id:0
server_principal_id:0
database_principal_id:0
target_server_principal_id:0
target_database_principal_id:0
object_id:0
user_defined_event_id:0
transaction_id:0
class_type:LX
duration_milliseconds:0
response_rows:0
affected_rows:0
client_ip:10.122.11.71
permission_bitmask:00000000000000000000000000000000
sequence_group_id:259EA444-6A54-41A4-AB05-543F2CA2759D
session_server_principal_name:
server_principal_name:iamfake
server_principal_sid:
database_principal_name:
target_server_principal_name:
target_server_principal_sid:
target_database_principal_name:
server_instance_name:2019DB1
database_name:
schema_name:
object_name:
statement:Login failed for user \'iamfake\'. Reason: Could not find a login matching the name provided. [CLIENT: 10.1.11.71]
additional_information:<action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data"><pooled_connection>0</pooled_connection><error>0x00004818</error><state>5</state><address>10.1.11.71</address></action_info>
user_defined_information:
application_name:Microsoft® Windows® Operating System
.';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php