Thanks Magnus, I had just started looking at kv filter and using this:
kv {
source => "filebeat_message"
value_split => "="
field_split => "; "
}
Seems to split it up as required, the grok filter doesnt seem to work though even changing to TIMESTAMP_ISO8601 I still get a _grokparsefailure.
However Im guessing I should be able to just do this with the kv filter shouldnt i? Once its been through that I can use a date to set the timestamp to EventTIme?