$re = '/.*"(?:GET|HEAD|OPTIONS|TRACE|CONNECT|PATCH)\s+[^"]*"\s+(?:-)?(\d+)?\s+(\d+).*/';
$str = '28.4.27.6 - - [24/Jul/2016:22:39:57 -0700] "GET /em/faces/consoleStatus.jsp HTTP/1.1" 302 53301 [ecid: 1.0000Kmv_oiW1NeP5If_Aif1LBVVM00000L;kXhgv0ZGZKSULGSPXKTPJHSRo4USpLO] [User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3) OracleEMAgentURLTiming/3.0]';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php