hippo's reply hopefully makes clear: the sample input you have shown appears to still not really be representative of real-world data, because I assume there is a chance that the "s-port" may not always be 443, and the user agent is unlikely to always start with curl, etc. Sorry, but what you have told us so far is still not enough information to build a robust parser. For example, if you assumed that the regex I showed will always match twice per line, and then your log file happens to contain an IP address in the cs-uri-stem cs-uri-query fields, and/or a hostname in one of the s-ip c-ip fields, code based on this assumption will break.

The way I would suggest approaching this is to see if you can find out more specifications about the fields - in particular, whether any of the date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip fields may contain whitespace, and if they can, how they might be delimited, etc. If, for example, the specification says that none of these fields may contain whitespace, it may turn out that LanX's suggestion of split may be enough. But if not, you'll have to write a regex to parse the line.