Hello,
I need to use the Key-Value processor to extract fields using Ingest Pipeline. Unfortunately, there are spaces in the field value. How do they have such a log extract the fields.
field=1 field2=2 field3=Nov 25 2024, 09:00:19 UTC field4=5
I can't use dissect because the logs have different structure. My idea is to use gsub. In the case of logstash I found such a hint. mutate { gsub => [“message”, “(\S+=)”, “, \1”] } however \1 in ingest pipline gives 1.