Indexer failures and regex with set_field in Pipeline 2

Graylog Central (peer support)
11

Hi all,
When @jan proposed to use key-value i have thought about Extractors, but in Graylog also exists function key-value, so I used it and have needed result, but with few exceptions.
First exception:
log_component="Firewall Rule"
this string is a pitfall for key-value and split functions as it have delimeter(whitespace) of entire message inside value.
Second exception:
for ordering fields I must had to make special field names to have it alphabetical.
So, solution for me looks like this (of course it’s not elegant, but works) :

rule "Sophos sorted 3"
when
    true
then
    let str_msg = to_string($message.message);
    
    let values = key_value(str_msg);
    
    set_field("fw11_device_name", values["device_name"]);
    set_field("fw12_log_id", values["log_id"]);
    set_field("fw13_log_type", values["log_type"]);
    set_field("fw14_log_subtype", values["log_subtype"]);
    set_field("fw15_status", values["status"]);
    set_field("fw16_username", values["username"]);
    set_field("fw17_rule_id", values["fw_rule_id"]);
    set_field("fw18_protocol", values["protocol"]);

    set_field("fw21_src_ip", values["src_ip"]);
    set_field("fw22_src_port", values["src_port"]);
    set_field("fw23_local_interfaceip", values["in_interface"]);
    
    set_field("fw31_dst_ip", values["dst_ip"]);
    set_field("fw32_dst_port", values["dst_port"]);
    set_field("fw33_remote_interfaceip", values["out_interface"]);
    
    set_field("fw41_timezone", values["timezone"]);
    set_field("fw42_time", values["time"]);
    set_field("fw43_date", values["date"]);
end

This was my first topic on the forum, so sorry for the confusion in questions and answers.
Thank you all!