$re = '/\w{3}\s\d{2}\s\d{2}:\d{2}:\d{2}\s\w+\s\w+\[\d+\]:\squery\[\w+\]\s([\da-z\.-]+\.[a-z]{2,6})\s\w+\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/m';
$str = 'Jul 30 00:00:41 rpi dnsmasq[571]: query[A] officescan.corp.arcon.com.br from 192.168.5.187
Jul 30 00:00:43 rpi dnsmasq[571]: query[A] teams.events.data.microsoft.com from 192.168.5.187
Jul 30 00:00:43 rpi dnsmasq[571]: forwarded teams.events.data.microsoft.com to 1.0.0.1
Jul 30 00:00:43 rpi dnsmasq[571]: forwarded teams.events.data.microsoft.com to 1.1.1.1
Jul 30 00:00:43 rpi dnsmasq[571]: reply teams.events.data.microsoft.com is <CNAME>
Jul 30 00:00:43 rpi dnsmasq[571]: reply teams-events-data.trafficmanager.net is <CNAME>
Jul 30 00:00:43 rpi dnsmasq[571]: reply skypedataprdcolweu02.cloudapp.net is 52.114.74.43
';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php