Matching Multiple Alterations with Regex

You may use

^date_time=([\d-]+ [\d:]+) user=(.+?) ip_address=([\d.]+) origin=(.+?) action=(.+?)(?: password=((?:(?!\w+=).)*))?(?: project=((?:(?!\w+=).)*))?(?: additional=(.+?))?$

See the regex demo.

Details:

• ^ - start of string
• date_time= - literal char sequence
• ([\d-]+ [\d:]+) - Group 1: one or more digits or -, space, and 1+ digits or :
• user= - literal char sequence
• (.+?) - Group 2: any 1+ chars as few as possible
• ip_address= - literal char sequence
• ([\d.]+) - Group 3: one or more digits or .
• origin= - literal char sequence
• (.+?) - Group 4: any 1+ chars as few as possible
• action= - literal char sequence
• (.+?) - Group 5: any 1+ chars as few as possible
• (?: password=((?:(?!\w+=).)*))? - an optional group matching a sequence of:
  • password= - literal char sequence
  • ((?:(?!\w+=).)*) - a tempered greedy token matching 0 or more occurrences of any char that is not a starting sequence for 1+ word chars followed with =
• (?: project=((?:(?!\w+=).)*))? - similar to above
• (?: additional=(.+?))? - similar to above, the tempered greedy token is replaced with .+? to match any 1+ chars, as few as possible
• $ - end of string.

Why not just split it on key/value pairs? Should be much easier, and better for future adaptability. Also will be easier on the Regex engine, and easier to read. Always the simpler the better.

(\w+=)

You can test it on Rextester or Regex101

No fancy regex but this would work:

$date,$user,$ipaddress,$origin,$action,$password,$project,$additional ="YourString" -replace "date_time=" -split "user=|ip_address=|origin=|action=|password=|project="

Your variables are ready to use. If optional tags don't exist then they are set to $Null.