Graylog Forwarder

Graylog Central (peer support)
4

Try this:

rule "Parsing key/value pairs"
when
    true
then
    set_fields
        (
        fields: key_value
            (
            value: to_string($message.message),
            trim_key_chars: "",
            trim_value_chars:"\"",
            delimiters: " ",
            kv_delimiters: "="
            )
        );
end

This should work if you’re sending the logs to a RAW input