Parsing advice on internally made log messages

Graylog Central (peer support)
1

Hello,

I’m looking for your opinion on a log I’d like to parse, issued from log4j2 :

  25/03/20 15:49:47 - [2252603324 ms] 
	kALByFHDCvmVBsJp - admin	127.0.0.1	some / string
	1rVFkKMOvFbyQ6Yw - admin	127.0.0.1	some / other /string
	hybjjeQ7Jo3WY8DC - admin	127.0.0.1	some / other / string (and stuff)

I extracted the timestamp, the integer before “ms”.
And then, I don’t have a clue how to manage the rest of the message.
One field cannot have more than one value…

How would you do it ? if doeable ?

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.