I’m looking for your opinion on a log I’d like to parse, issued from log4j2 :
25/03/20 15:49:47 - [2252603324 ms] kALByFHDCvmVBsJp - admin 127.0.0.1 some / string 1rVFkKMOvFbyQ6Yw - admin 127.0.0.1 some / other /string hybjjeQ7Jo3WY8DC - admin 127.0.0.1 some / other / string (and stuff)
I extracted the timestamp, the integer before “ms”.
And then, I don’t have a clue how to manage the rest of the message.
One field cannot have more than one value…
How would you do it ? if doeable ?