use strict; use warnings; use Data::Dumper; my $rxExtractFields = qr {(?x) \s* (\S+) = \s* (\S.*?) (?= \s*\S+= | \z ) }; open my $inFH, q{<}, \ <<'END_OF_FILE' or die qq{open: $!\n}; 2007-11-16 16:04:33 Local1.Alert 128.29.29.40 id=firewall time="2007-11-16 16:04:08" fw=WS2000-Store 29 pri=1 proto=6(tcp) src=128.29.29.200 dst=128.29.100.102 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4412 from EXT n/w agent=Firewall 2007-11-16 16:05:05 Local1.Alert 128.24.24.40 id=firewall time="2007-11-16 16:03:25" fw=WS2000-Store 24 pri=1 proto=6(tcp) src=128.24.24.200 dst=128.24.100.101 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4344 from EXT n/w agent=Firewall 2007-11-16 16:05:34 Local1.Alert 128.29.29.40 id=firewall time="2007-11-16 16:05:09" fw=WS2000-Store 29 pri=1 proto=6(tcp) src=128.29.29.200 dst=128.29.100.102 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4412 from EXT n/w agent=Firewall 2007-11-16 16:05:39 Local1.Alert 128.2.2.40 id=firewall time="2007-11-16 16:03:36" fw=WS2000-Store 02 pri=1 proto=6(tcp) src=128.2.2.200 dst=128.2.100.106 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4631 from EXT n/w agent=Firewall 2007-11-16 16:05:40 Local1.Alert 128.2.2.40 id=firewall time="2007-11-16 16:03:36" fw=WS2000-Store 02 pri=1 proto=6(tcp) src=128.2.2.200 dst=128.2.100.106 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4631 from EXT n/w agent=Firewall 2007-11-16 16:05:40 Local1.Alert 128.2.2.40 id=firewall time="2007-11-16 16:03:37" fw=WS2000-Store 02 pri=1 proto=6(tcp) src=128.2.2.200 dst=128.2.100.106 mid= 1013 mtp= 2 msg=TCP connection request received is invalid, dropping packet Src 23 Dst 4631 from EXT n/w agent=Firewall END_OF_FILE my @parsedData = (); while ( <$inFH> ) { chomp; my ( $date, $time, $type, $ip, $restOfLine ) = split m{\s+}, $_, 5; my %pairs = $restOfLine =~ m{$rxExtractFields}g; push @parsedData, { field1 => $date, field2 => $time, field3 => $type, field4 => $ip, %pairs, }; } close $inFH or die qq{close: $!\n}; print Data::Dumper->Dumpxs( [ \ @parsedData], [ q{*parsedData} ] );