Im creating a pipeline for my logs but the pipeline somehow changes my logs. Here is a Picture.
in the Rule Simulation i give the original log message. In this message almost every field-value has quotation marks. But below in the message field none of these field-values have quotation marks and also the key-value pairs have a ‘:’ instead of a ‘=’. Why is this so? If I try to extract the fields mit quotation marks i get nothing and if I extract without the quotation marks I get these values, but cannot extract all because. Can I somehow use the original message of my logs? Or am i using the wrong functions in the source code editor?