Hey folks. We're in the process of migrating our internal monitoring stack and are evaluating Sumo Logic. One of our key sticking points is parsing logs from a legacy, home-grown application. The log format is... let's call it "idiosyncratic." It's not standard JSON, syslog, or any common structured format. It's a semi-colon delimited mess with variable fields depending on the event type.
I've read the docs on Sumo's parsers, but I'm looking for real-world experience. For those of you who've built custom parsers for non-standard logs:
* Did you find the parse regex operator flexible enough for complex, multi-line scenarios?
* Any major performance hits or gotchas when applying a custom parser to high-volume sources?
* Is it better to handle the parsing at the source (e.g., with a Fluentd filter) before ingestion, or lean entirely on Sumo?
Our format looks vaguely like this, but with nested inconsistencies:
`EVENT=START; ID=12345; TIMESTAMP=2023-...; [DATA=value1;value2;];`
I'm particularly wary of building something that becomes a maintenance nightmare. Would love to hear your war stories on what worked and what to avoid.