What is the most effective way to parse logs with lots of optionnal fields?

[tmacgbay]

Here is a note on how I handled firewall traffic coming from PaloAlto firewalls:

Unable to Import Palo Alto Networks Content Packs

I tried to be good and create a content pack but man that interface is just soooo wonky… All I was trying to do is put out pipelines and their rules and extract the extra stuff I have in there… AND you have to get it 100% right because although I can edit all I want in github, once you post in Graylog Marketplace, the only thing you can change is the title (LAME!) Ok… done complaining. I am posting my rules in sequence here. I am assuming your input works and you know how to …