I'm receiving syslogs from different equipment with quite different formats, but every log always starts with something like this:
<188>time=..... or <177>id=.....
So, each time that I apply kv, I got a field named like: <188>time, <187>time and so on.
I would like to trim o remove this part of the field, but a couldn't find a way to write in the conf file an expression to solved it. The result always is that only the first "<" get removed.