$re = '/(?P<event_message>An account was logged off.)\s+Subject:\s+Security ID:\s+(?P<subject_security_id>.*?)\s+Account Name:\s+(?P<subject_account_name>.*?)\s+Account Domain:\s+(?P<subject_account_domain>.*?)\s+Logon ID:\s+(?P<subject_logon_id>.*?)\s+Logon Type:\s+(?P<logon_type>.*?)\s+(?P<event_details>.*)/';
$str = 'An account was logged off. Subject: Security ID: S-1-5-21-2883959765-1550083997-3048789898-500 Account Name: Administrator Account Domain: WIN2K12-TEST Logon ID: 0x8398DA6 Logon Type: 3 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer."';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php