As 1nickt suggested, you might find it easier to break the problem down into steps rather than trying to do it in one go. First separate the date, then extract the message from the remainder. For example

#!/usr/bin/perl
use strict;

# month numbers
my %mno = (jan=>1,feb=>2,mar=>3,apr=>4, may=>5, jun=>6, 
           jul=>7,aug=>8,sep=>9,oct=>10,nov=>11,dec=>12);

# define date formats
my $df1 = qr[... ... \d{2} \d{2}:\d{2}:\d{2} 20\d\d];
my $df2 = qr[20\d{2}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{6}];

# process log
while (<DATA>){
  chomp;
  if (/^($df1|$df2)\s+(.*)/){
    my ($date,$time) = format_date($1);
    my $msg  = $2;
    my $severity;
    my $err;
    
    if ($msg =~ /(\S*info:.*)/){
      $severity = 'INFO';
      $err = $1;
    }
    
    if ($msg =~ /(\[INFORMATION\])\s+(.*)/){
      $severity = 'INFO';
      $err = $2;
      $err =~ s/^\[.*\] +//; # remove [AGENTEXEC 26816]
    }
    
    print "$date\t$time\t$severity\t$err\n";
  }
}

# Mon Feb 20 09:31:25 2017
sub format_date {
  my $date = shift;
  my $time;
  if ($date =~/(...) (\d{2}) (\d{2}:\d{2}:\d{2}) (20\d\d)/){
    $date  = sprintf "%4d-%02d-%02d",$4,$mno{lc $1},$2;
    $time = $3;
  }
   if ($date =~/(.+)T(\d{2}:\d{2}:\d{2})/){
    $date  = $1;
    $time  = $2;
  } 
  return ($date,$time);
}

__DATA__
Mon Feb 20 09:31:25 2017 [INFORMATION] [AGENTEXEC 26816] Detected duri
+ng program initialization: Version: 7.2.0160.0297  Win64
2017-02-20T09:30:53.177000    20848[30892]    0000000000000000    [DM_
+MQ_I_DAEMON_START]info:  "Message queue daemon (tid : 27944, session 
+0102b20d80000456) is started sucessfully."

[download]
poj

In reply to Re^5: DateTime::Format::Flexible; for Log Parse with multiple formatted lines by poj
in thread DateTime::Format::Flexible; for Log Parse with multiple formatted lines by TCLion

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.