I'm trying to spit event into multiple events,my raw event like below <14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]<14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]<14>1 2022-09-14T12:49:12.727+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Login" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Login Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM" mftuser_name="testuser"] -------------------------------------------------------------------- I want to split it into three events, how can I do this? <14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]
<14>1 2022-09-14T12:49:12.620+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Connect" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Connection Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM"]
<14>1 2022-09-14T12:49:12.727+08:00 TestServer mft 3491 SFTP Audit Log [gamft-sftp@46583 mftcommand="Login" mftend_time="2022-09-14 12:49:12 PM" mftevent_type="Login Successful" mftremote_ip="192.168.168.168" mftstart_time="2022-09-14 12:49:12 PM" mftuser_name="testuser"]
... View more