Parsing a string to an array output from command line

TL;DR: This should work:

preg_match_all(',([a-z]+)="((?:[^"]|\\\\")*[^\\\\])",', $a, $matches, PREG_SET_ORDER);var_dump($matches);

The last var_dump prints the following data structure, which should be easy to process:

array(3) {  [0] => array(3) {    [0] => string(32) "time="2015-06-21T11:33:26+02:00""    [1] => string(4) "time"    [2] => string(25) "2015-06-21T11:33:26+02:00"  }  [1] => array(3) {    [0] => string(13) "level="fatal""    [1] => string(5) "level"    [2] => string(5) "fatal"  }  [2] => array(3) {    [0] => string(179) "msg="Error response from daemon: Conflict. The name \\"test\\" is already in use by container XXXXXXXX. You have to delete (or rename) that container to be able to reuse that name.""    [1] => string(3) "msg"    [2] => string(173) "Error response from daemon: Conflict. The name \\"test\\" is already in use by container XXXXXXXX. You have to delete (or rename) that container to be able to reuse that name."  }}

Why this works

The regular expression explained:

([a-z]+)                    # Match the label ("time", "level" or "msg")=                           # Self-explanatory"((?:[^"]|\\\\")*[^\\\\])"  # This is the tricky part:                            # Match the quoted string; this is a sequence                            # of (a) non-quote characters ([^"]) or                            # (b) escaped quote characters (\\\\").

Some other notes:

1. preg_split uses the regular expression to match token at which the string should be split. That's not what you want in this case; you want to return the parts of the string that was matched by the regular expression. For this, you should use preg_match (or if, like here, you want a pattern to match multiple times), preg_match_all.
2. Also consider the PREG_SET_ORDER flag for preg_match_all. This flag causes the $matches result to contain one row for each label from output message, which makes the data structure easy to process. Try and see what happens if you leave it out.

It's because of the greedy dot that eats up your string to the last ". Make it lazy, would do like that:

if(preg_match_all('/(\w+)="(.*?)(?<!\\\)"/s', $str, $out))  print_r(array_combine($out[1], $out[2]));

\w is a short for [a-zA-Z0-9_]. The lookbehind (?<!\\\) to eat up escaped quotes (see regex101).

Used s flag for making the dot match newline. Test at eval.in, outputs to:

Array ( [time] => 2015-06-21T11:33:26+02:00 [level] => fatal [msg] => Error response from daemon: Conflict. The name \"test\" is already in use by container XXXXXXXX. You have to delete (or rename) that container to be able to reuse that name. )