Netscout arbor legacy syslog parsing - Audit log issue

Elastic Stack Logstash
5

Your field split is not a space, it is a comma.

Try this kv

filter {
    kv {
        field_split => ","
        value_split => ":"
        trim_key => "\s"
    }
}

Running it for the message

user: kyloren, timestamp: 18:21 04/12/22, device: FW-DOS01, name: PG-FW-01-DD, action: Update, type: Protection Group, message: , descr_short: Updated Protection Group PG-FW-01-DD, descr_long: Updated Protection Group PG-FW-01-DD, url: https://FW-DOS01/audittrail?audit_component=25&audit_obj_id=161

It gives the following result:

{
      "timestamp" => "18:21 04/12/22",
           "name" => "PG-FW-01-DD",
           "user" => "kyloren",
    "descr_short" => "Updated Protection Group PG-FW-01-DD",
       "@version" => "1",
            "url" => "https://FW-DOS01/audittrail?audit_component=25&audit_obj_id=161",
     "@timestamp" => 2022-04-14T12:37:04.320Z,
         "action" => "Update",
        "message" => "user: kyloren, timestamp: 18:21 04/12/22, device: FW-DOS01, name: PG-FW-01-DD, action: Update, type: Protection Group, message: , descr_short: Updated Protection Group PG-FW-01-DD, descr_long: Updated Protection Group PG-FW-01-DD, url: https://FW-DOS01/audittrail?audit_component=25&audit_obj_id=161",
     "descr_long" => "Updated Protection Group PG-FW-01-DD",
         "device" => "FW-DOS01",
           "type" => "Protection Group"
}