somthing apache24 up 11572 Mar 15 16:25 161.20.224.243:8808 161.20.224.243:8802 161.20.224.243:8809 #### qr/ ^\s* (\S+) ## something \s+ (\S+) ## apache24 \s+ (\S+) ## up \s+ (\S+) ## 11572 \s+ (.*?) ## date-time (?: ## start non-capturing group for ports* \s+ ( ## PORTS (?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}) [.] (?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}) [.] (?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}) [.] (?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}) [:] \d+ ) )+ ## end non-capturing group for ports* $ /x