fluent.conf

<match pattern>
  @type key_value_parser
  key log
  remove_key true
  remove_prefix /^[^ ]+\s[^ ]+/
  use_regex true
  filtered_keys none
  filtered_keys_regex /^sub_[a-zA-Z_0-9]+/
</match>

## Input Data 
{
  'time' => '2013-02-12 22:01:15 UTC',
  'log'  => "Start Request sub_key=0 sub_akey=11 sub_zkey=12 key=10 gkey=100 nkey=108 skey='this is a miltispace line' akey=20 zkey=30 dkey=4"
}

## Output Data
{
  "time"=>"2013-02-12 22:01:15 UTC",
  "sub_key"=>"0",
  "sub_akey"=>"11",
  "sub_zkey"=>"12"
}