I'm trying to set up a parser for the Sonicwall firewall.
I stop at moment on message.
I have two similar messages:
msg="Connection Closed" app=7927 n=12234655
msg="Connection Opened" app=49177 appName="General HTTPS" n=5319205
as you see on one is "appName". I worry that If this is missing in line, the parser will give me en error. Or not?
At moment whole message is in one column but I want to split it into different columns.

Hi Toby
Thanks for your response and info.
I will look into this multi parser.

Regarding key-value I think this will be useful in some cases, so waiting to hear about a new version of your app. 

Marcin