Just saved $12k/month on our Splunk bill. Here's the exact Cribl filter logic.

Agreed that parsing for structured fields is the long-term fix. The stopgap approach with multiple regex functions is useful, but I'd add a caution about execution order. Chaining several regex operations on the same `_raw` field, even conditionally, can create quadratic overhead on your workers if you're not careful with the pattern logic.

A better interim step is a single `Regex Extract` with a capture group for the log level, using an alternation pattern for your common timestamp prefixes. That gives you a structured field in one pass, which you can then filter on downstream. It's still a regex cost, but it's linear and sets you up for the parser migration.