$re = '/\W+\w+\W+(?<EventTime>[^\\\\]+)\W+\w+\W+(?<HostName>[^\\\\]+).+?EventID\W+(?<EventID>[^,]+).+?Message\W+(?<Message>[^,]+(?=\\\\)).+/';
$str = '\\"EventTime\\":\\"2017-08-11 10:40:07\\",\\"Hostname\\":\\"School4\\",\\"Keywords\\":-9187343239835811840,\\"EventType\\":\\"INFO\\",\\"SeverityValue\\":2,\\"Severity\\":\\"INFO\\",\\"EventID\\":7036,\\"SourceName\\":\\"Service Control Manager\\",\\"ProviderGuid\\":\\"{555908D1-A6D7-4695-8E1E-26931D2012F4}\\",\\"Version\\":0,\\"Task\\":0,\\"OpcodeValue\\":0,\\"RecordNumber\\":263066,\\"ProcessID\\":548,\\"ThreadID\\":7528,\\"Channel\\":\\"System\\",\\"Message\\":\\"Application Experience \\xBC\\xAD\\xBA\\u{7DEB0}\\xA1 \\xC1\\xDF\\xC1\\xF6 \\xBB\\xF3\\xC5·\\xCE \\xB5\\xE9\\xBE\\xBD\\xC0\\xB4ϴ\\xD9.\\",\\"param1\\":\\"Application Experience\\",\\"param2\\":\\"\\xC1\\xDF\\xC1\\xF6\\",\\"EventReceivedTime\\":1502415607,\\"SourceModuleName\\":\\"in\\",\\"SourceModuleType\\":\\"im_msvistalog\\"';
preg_match($re, $str, $matches, PREG_OFFSET_CAPTURE, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php