Problem with KV when = delimiter sign is present in the value

[Luigius]

Hi
I have a log that uses as KV separator the = sign, inside some fields (which are delimited by quotas) sometimes the = sign is present as a result that all strings become a key.

example:
Sep 16 21:12:04 _gateway date=2021-09-16,time=21: 12:04,dstport=80,url="/setup.cgi?next_file=netgear.cfg",direction="outgoing"

become:
{"dstport":80,"url="setup.cgi?next_file":"netgear.cfg"","direction":"outgoing"}

instead of:
{"dstport":80,"url":"setup.cgi?next_file=netgear.cfg","direction":"outgoing"}

Any suggestion?
Thanks

[b1scuit-thi3f]

Hi,
We had the same problem and found that actually the original ltsv parser actually handles this!
https://docs.fluentd.org/parser/ltsv