text = "inforun 7970 12423 99 10:03 ? 00:09:03 abcd -PR -gmh domain.den.abc.com -gmp 6020 -guid 9c06cc02-b1c8-41cf-93e6-1d795e9fff62 -rst 180 -s FOLDER_NAME:wkf_workflow.s_session -something Session task instance [session]" text =~ /(?<=\s)(\d{2}:\d{2})(?=\s).*?(?<=\s)((?:[a-zA-Z\d]+(?:\-[a-zA-Z\d]+)*\.)+[a-zA-Z]{2,4})(?=\s).*?(?<=\s)([a-zA-Z\d_]+):wkf_([a-zA-Z\d]+)\.s_([a-zA-Z\d]+)(?=\s)/ puts $~.captures