Issue with winlog + logfmt

[jalf]

Hi Folks,

I get an event like this from Windows Events:

[959] winlog.0: [1680276314.533750700, {"RecordNumber"=>17676, "TimeGenerated"=>"2023-03-31 12:53:00 +0000", "TimeWritten"=>"2023-03-31 12:53:00 +0000", "EventID"=>0, "Qualifiers"=>0, "EventType"=>"Information", "EventCategory"=>0, "Channel"=>"Application", "SourceName"=>"application", "ComputerName"=>"ip-0A0007FC", "Data"=>"", "Sid"=>"", "Message"=>"", "StringInserts"=>["2023-03-31T12:53:00.000Z VTEXKpi,pci,i-06e931a0cec6c8999,default,"RouteStats",0.00,1,0.00,0.00,-,2.0.1.0 routeName="FakePaymentProviderApiController.SettlePayment" statusCode="200" method="POST" environment="gtw-env-beta" "], "vtex.search_index"=>"pci_dev", "host"=>"i-06e931a0cec6c8999"}]

With an filter like this:

[FILTER]
	Name parser
	Match *
	Key_Name StringInserts
	Parser keyvalue
	Reserve_Data On
	Preserve_Key On

[PARSER]
	Name keyvalue
	Format logfmt

I see the string method="POST" in the StringInserts record, but why the record method=>"POST" is not created? Did i miss something? Is ia bug?

Please help!

[jalf]

For the record, this conf works fine:

[SERVICE]
	Parsers_File ./parser.conf

[INPUT]
	Name dummy
	Tag  winlog.0
	Dummy {"StringInserts":"2023-03-31T12:53:00.000Z VTEXKpi,pci,i-06e931a0cec6c8999,default,\"WorkerGetLotCount\",0.00,30,0.00,0.00,-,2.0.1.0 workerEventType=\"TransactionFinish\" environment=\"gtw-env-beta\""}

[OUTPUT]
	Name stdout
	Match *

[FILTER]
	Name parser
	Match *
	Key_Name StringInserts
	Parser keyvalue
	Reserve_Data On
	Preserve_Key On

[FILTER]
	Name record_modifier
	Match *
	Record vtex.search_index pci_dev
	Record host i-06e931a0cec6c8999