How can I drop part of a syslog header?
my raw event looks like this α _raw:
`*Mar 31 09:21:11 10.x.x.x* time=1680239950|hostname=D-xxxx|product=test`
I want to drop only the syslog header part (shown in Bold above) I am trying to use parse with extract and serialize. I also tried with parse (reserialize) but the full event length is going high, I need to drop header and reduce the size of full event as well... how can I do this?