what is the difference between using pipe vs without pipe?

Our regex:

1-) "([0-9a-f]{4}:[0-9a-f]{2}:[0-9a-f]{2}\.[0-9a-f] | [0-9a-f]{4}:[0-9a-f]{4}:[0-9a-f]{4}\.[0-9a-f]{4})"
2-)"([0-9a-f]{4}:[0-9a-f]{2}:[0-9a-f]{2}\.[0-9a-f]"

my input file:

Nov 02 17:20:45 host kernel: [drm] [nvidia-drm] [GPU ID 0x00000100] Loading driver
Nov 02 17:20:45 host kernel: [drm] Initialized nvidia-drm 0.0.0 20160202 for 0000:01:00.0
Nov 02 17:20:47 host kernel: intel_rapl_common: Found RAPL domain package
Nov 02 17:20:47 host kernel: intel_rapl_common: Found RAPL domain core
Nov 02 17:20:47 host kernel: intel_rapl_common: Found RAPL domain uncore
Nov 02 17:20:47 host kernel: intel_rapl_common: Found RAPL domain dram
Nov 02 17:20:48 host kernel: broken atomic modeset userspace detected, disabling atomic
Nov 02 17:20:49 host kernel: r8169 0000:03:00.1 enp3s0f1: Link is Up - 1Gbps/Full
Nov 02 17:20:49 host kernel: IPv6: ADDRCONF(NETDEV_CHANGE): enp3s0f1: link becomes ready
Nov 02 17:20:50 host kernel: Bluetooth: RFCOMM TTY layer initialized
Nov 02 17:20:50 host kernel: Bluetooth: RFCOMM socket layer initialized
Nov 02 17:20:50 host kernel: Bluetooth: RFCOMM ver 1.11
Nov 02 17:20:51 host kernel: kauditd_printk_skb: 22 callbacks suppressed
Nov 02 17:20:51 host kernel: kauditd_printk_skb: 22 callbacks 0003:004f:0007.0001 suppressed

second regex finds these two lines

Nov 02 17:20:45 host kernel: [drm] Initialized nvidia-drm 0.0.0 20160202 for 0000:01:00.0
Nov 02 17:20:49 host kernel: r8169 0000:03:00.1 enp3s0f1: Link is Up - 1Gbps/Full

but if i change like first and add pipe then it finds

Nov 02 17:20:49 host kernel: r8169 0000:03:00.1 enp3s0f1: Link is Up - 1Gbps/Full
Nov 02 17:20:51 host kernel: kauditd_printk_skb: 22 callbacks 0003:004f:0007.0001 suppressed

why it does not find the "Nov 02 17:20:45 host kernel: [drm] Initialized nvidia-drm 0.0.0 20160202 for 0000:01:00.0". I know that pipe is a union for those sets but if i use pipe, the line will not find. What is wrong in my thoughts and how can i fix it?