From your example:
rex " \"(?<ip>(?:\d{1,3}\.){3}\d{1,3})\"\s(?<first>\d+\.\d+)\s(?<second>\d+\.\d+)\s\.$"
Let's break it down.
\" match literal double quote
(? create new capture group named ip
(?: create new non capture group
\d{1,3}\.){3} match 3 occurances of 1 to 3 digits followed by a literal .
\d{1,3} match one occurance of 1 to 3 digits
\"\s match literal double quote and space
(? create new capture group named first
\d+\.\d+) capture one or more digits followed by a literal . followed by one or more digits
\s match literal space
(?\d+\.\d+) same as before
\s\.$ match literal space, literal . and end of line $
... View more