Here is the event structure
{
"message" => "2016/11/03 13:52:14 kid1| urlParse: URL too large (8860 bytes)",
"@version" => "1",
"@timestamp" => "2016-11-03T12:52:15.071Z",
"type" => "squidservice_mobylette",
"tags" => [
[0] "serveur_proxy",
[1] "squidservice_mobylette",
[2] "squidservice",
[3] "mobylette",
[4] "RES",
[5] "groked"
],
"host" => "mobylette",
"path" => "/var/log/squid/cache.log",
"squid_timestamp" => "2016/11/03 13:52:14",
"content" => "urlParse: URL too large (8860 bytes)"
}