I have an input receiving messages following the pattern presented bellow:
hostname=myHost service=myServiceName time="2017-04-26T10:22:42+01:00" level=info message="Here goes the log message"
I’d like to create an extractor “Copy Input” type, and apply the key value converter.
-> What’s the correct value to “store as field”?
-> Message field does not override the original message. I think it would be nice to replace the original message with the field “message=” content. Is that possible without adding additional converters and complexities?