I came up with the following, which isn't 100% there. The difficulty is that some keys use underscores ("device_id") and others do not ("src zone"). Is there a way to fix this in the application/configuration? Is it correct assuming that "proto" goes with "6"?

Update: New pattern... 
/
    ((?:src\s|dst\s|translated\s)?\S+)
    \n?
    =
    (")?
    ((?:(?(2)[^"]|\S)(?!\S+=))+)
/xmg;

[download]
 
use warnings;
use strict;
use Data::Dumper;

my %hash;
my @records;
my $record;
{
    local $/ = "\n\n";
    @records = <DATA>;
}
for (@records) {
    ++$record;
    $hash{$record}{$1} = $3 while $_ =~ /(\S+)=(")?((?:(?(2)[^"]|\S)(?
+!\S+=))+)/mg;
}

print Data::Dumper->Dump([\%hash]);

__DATA__

messages:Dec 17 09:41:08 10.14.93.7 ns5xp: NetScreen device_id=ns5xp  
system-notification-00257(traffic): start_time="2002-12-17 09:45:58" d
+uration=5 policy_id=0 service=tcp/port:8000 proto
=6 src zone=Trust dst zone=Untrust action=Permit sent=1034 rcvd=19829 
+src=10.14.94.221 dst=10.14.90.217 src_port=1059 dst_port=8000 transla
+ted ip=10.14.93.7 port=1223

messages:Dec 17 09:41:08 10.14.93.7 ns5xp: NetScreen device_id=ns5xp  
+system-notification-00257(traffic): start_time="2002-12-17 09:45:59" 
+duration=4 policy_id=0 service=tcp/port:8000 proto
=6 src zone=Trust dst zone=Untrust action=Permit sent=722 rcvd=520 src
+=10.14.94.221 dst=10.14.90.217 src_port=1060 dst_port=8000 translated
+ ip=10.14.93.7 port=1224

[download]

In reply to Re: Parsing text files with a regex lookahead by eff_i_g
in thread Parsing text files with a regex lookahead by jalewis2

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.