Hmm, do you mean that using a space as a delimiter in a grok pattern won’t work, or that having a space in the field name is what causes the issue?
I’ve tested the grok pattern using “test with sample data” function which seemed to work fine. Here’s the pattern, for reference:
(?%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{DATA:Server_IP} %{DATA:Method} %{DATA:URI_Stem} %{DATA:URI_Query} %{DATA:Server_Port} %{DATA:Client_Username} %{DATA:Client_IP} %{DATA:Client_UserAgent} %{DATA:Referrer} %{DATA:HTTP_Status} %{DATA:Protocol_Substatus} %{DATA:Win32_Status} %{DATA:Time_Taken} %{DATA:X-Forwarder-For}$
We’ve temporarily setup input extractors, but at the moment we’ve configured multiple kinds of logs to go to the same input, so I’m wondering whether an input extractor is the better method or whether using pipelines would scale better?