Here is another example:
2020-02-20T10:58:01.951+0100 ERROR [syslog] syslog/input.go:243 can't parse event as syslog rfc3164 {"message": "CEF:0|Corp|System|1.3.2|Read1|Read|Unknown| eventId=7600 msg=N.SYS II QueryJob Person\\=Object[ObjectName\\=SearchRequest;Query\\=Object[ObjectName\\=PersonQuery;DateOfBirth\\=7803;SearchSystem\\=[SYS;];Gender\\=Object[ObjectName\\=ReferenceData;Dictionary\\=SYS_1;Category\\=GENDER;Code\\=M;];FamilyNames\\=TEST;AlertRequestingUser\\=[];Nationality\\=Object[ObjectName\\=ReferenceData;Dictionary\\=ISO_3166_1_ALPHA_3;Category\\=COUNTRY;Code\\=SWE;];];]; categorySignificance=/Normal categoryBehavior=/Access categoryDeviceGroup=/Application categoryOutcome=/Success categoryObject=/Host/Application/Service art=1582192681204 act=FV2 rt=1582192681012 suid=002021002163 spriv=1 dhost=server.utv.corp.se dst=172.16.1.101 destinationZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 dmac=00-50-56-B3-85-A9 destinationServiceName=SYSTEM filePermission=1 cs1=ALERT cs2=No id found. cs3=TrackingId cs5=54844ff0-1111-2222-1111-48529f14007e flexNumber2=6981 deviceCustomDate1=1582192681013 cs1Label=Objekttyp cs2Label=ObjektID cs3Label=Objektidtyp cs4Label=Info cs5Label=LogMapID cs6Label=Reserv5 flexNumber2Label=LopNummer ahost=server.utv.corp.se agt=172.16.2.101 agentZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 amac=00-55-56-B3-55-3B av=7.13.0.8178.0 atz=Europe/Stockholm at=file dvchost=serverino dvc=172.16.1.101 deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 deviceNtDomain=F dtz=Europe/Stockholm deviceProcessName=MODE geid=0 _cefVer=0.1 aid=3H+nSPXABABCqh6EN5f-+8A\\=\\="}