$regex = '/^[([^]]+)] [([^]]+)] (?:[client ([^]]+)])?s*(.*)$/i'; preg_match($regex, $log, $matches); $matches[1] = Date and time, $matches[2] = severity, $matches[3] = client addr (if present) $matches[4] = log message