# IP address ( sort of ) -- too lazy to come up with 
# a more elaborate RE.... I'm sure somebody knows of
# a *real* RE for this :-)
# assuming it's never empty
(?:\d?\d?\d\.\d?\d?\d\.\d?\d?\d\.\d?\d?\d)

# HTTP code
# assuming it's never empty
\d\d\d

# bytes ( "-" if none )
(?:\d+|-)

# date. assuming it's never empty
[
   (?:[12][0-9]|3[01]|[1-9]) # date 10-19,20-29,30,31,1-9
     /
   (?:J(?:un|ul|an)|Feb|Ma(?:r|y)|A(?:pr|ug)|Sep|Oct|Nov|Dev) # month 
     /
   \d\d\d\d # year
     :
   (?:[01][0-9]|2[0-3]):(?:[0-5][0-9]):(?:[0-5][0-9]) # time
]
# HTTP Request -- don't know what the RFC says about this,
# so will stick with a simple one.
# assuming it's never empty
"[^"]+"

# Referrer
"(?:[^"]+|-)"

# I don't know what the second and third field does.
(?:\S+|-)