Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes. ... View more

Ooh, it stripped my escapes in the above. My first suggested format escaped the embedded " with backslashes. ... View more

Great stuff! Thanks! I am doing all of the stuff in the early paragraphs of "Logging Best Practices." I am not using commas but I could trivially -- do commas really help? (I am just using spaces.) Everything is keyword label=value label="value with embedded blanks" separated by spaces. What about embedded quotation marks in quoted strings? What is the standard? label="As the saying goes, \"a stitch in time saves nine\"" label="As the saying goes, ""a stitch in time saves nine""" label='As the saying goes, "a stitch in time saves nine"' For Syslog data that is standard RFC 3164: mmm dd hh:mm:ss hostname and then the tag=value formats above, what should be the pretrained source type? Thanks again. Don't see a "mark as answer" button. ... View more