Otherwise it’s in some cases interpreting anything around an ‘=’ sign, even if there is no space delimiter, as a key=value pair and extracting it?
The extractor does exactly that - So the extractor key-value is not that powerful. The processing pipeline key-value function can be configured more deeply:
key_value(value: to_string(message), trim_value_chars: "\"", trim_key_chars:"\"", delimiters:" ", kv_delimiters:"=");
This would prefend the = in the value is used to separate a new value from key.
You might get better results using the procesing pipelines.