New structured data parser

process_structured.rb

def process_structured(event)
    line = event.fields["tail"].first
    
    properties, message = line.split("] ", 2)
    properties.slice!(0)
    
    properties.split("][").each do |group|
      items = group.split
      name = items.slice!(0).split("@", 2).first
            
      items.each do |kv|
        key, value = kv.split('="', 2)
        event.fields["sd_#{name}_#{key || "nokey"}"] = value.chomp! || "novalue"
      end
    end
    
    event.fields["message"] = message || "nomsg"
    event.fields.delete("tail")
end