How to create fields dynamically?

[Badger]

Use a dissect filter to take off the date, then use a kv filter.

dissect { mapping => { "message" => [%{timestamp} %{+timestamp} %{restOfLine}" } }
kv { source => "restOfLine" }