Hello, is there an easy way to extract the individual fields from the

Message

in Sysmon logs so that they are structured and fully searchable in OpenSearch? Here’s an example of the JSON result I currently have (from opensearch after sending logs via fluent bit)"

{
  "_index": "windows-2025.10.21",
  "_id": "SGCQB5oBuk1sTIS_aKE-",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2025-10-21T16:17:41.329Z",
    "ProviderName": "Microsoft-Windows-Sysmon",
    "ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "Qualifiers": "",
    "EventID": 7,
    "Version": 3,
    "Level": 4,
    "Task": 7,
    "Opcode": 0,
    "Keywords": "0x8000000000000000",
    "TimeCreated": "2025-10-21 16:17:39 +0000",
    "EventRecordID": 9666,
    "ActivityID": "",
    "RelatedActivityID": "",
    "ProcessID": 5372,
    "ThreadID": 9092,
    "Channel": "Microsoft-Windows-Sysmon/Operational",
    "Computer": "win10",
    "UserID": "NT AUTHORITY\\SYSTEM",
    "Message": "Image loaded:\r\nRuleName: technique_id=T1053,technique_name=Scheduled Task\r\nUtcTime: 2025-10-21 16:17:39.502\r\nProcessGuid: {aa15f251-b20a-68f7-130b-000000000b00}\r\nProcessId: 8412\r\nImage: C:\\Windows\\System32\\sppsvc.exe\r\nImageLoaded: C:\\Windows\\System32\\taskschd.dll\r\nFileVersion: 10.0.19041.3636 (WinBuild.160101.0800)\r\nDescription: Task Scheduler COM API\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: taskschd.dll\r\nHashes: SHA1=633C92F5A5000CDE3235C7FDC306B2B04C501C48,MD5=84F942C1A4BD60C94EBEC6643E0216C9,SHA256=BBE733452E6CE871D5D2064948847AAB2A71F7FEDA2C962BA4002F64E2D198F2,IMPHASH=B7A4477FA36E2E5287EE76AC4AFCB05B\r\nSigned: true\r\nSignature: Microsoft Windows\r\nSignatureStatus: Valid\r\nUser: NT AUTHORITY\\NETWORK SERVICE",
    "StringInserts": [
      "technique_id=T1053,technique_name=Scheduled Task",
      "2025-10-21 16:17:39.502",
      "{AA15F251-B20A-68F7-130B-000000000B00}",
      8412,
      "C:\\Windows\\System32\\sppsvc.exe",
      "C:\\Windows\\System32\\taskschd.dll",
      "10.0.19041.3636 (WinBuild.160101.0800)",
      "Task Scheduler COM API",
      "Microsoft® Windows® Operating System",
      "Microsoft Corporation",
      "taskschd.dll",
      "SHA1=633C92F5A5000CDE3235C7FDC306B2B04C501C48,MD5=84F942C1A4BD60C94EBEC6643E0216C9,SHA256=BBE733452E6CE871D5D2064948847AAB2A71F7FEDA2C962BA4002F64E2D198F2,IMPHASH=B7A4477FA36E2E5287EE76AC4AFCB05B",
      "true",
      "Microsoft Windows",
      "Valid",
      "NT AUTHORITY\\NETWORK SERVICE"
    ]
  },
  "fields": {
    "@timestamp": [
      "2025-10-21T16:17:41.329Z"
    ]
  },
  "sort": [
    1761063461329
  ]
}

Yup, define a parser: https://docs.fluentbit.io/manual/data-pipeline/parsers

thank you for the reposne. the problem is there a different type of sysmon events, so do i need to create parser for each event type ? (using regex | lua ?)

Yeah unless they're common. Note that if a parser does not apply then the data is unchanged so you can always apply all of them to pick just the one you want.

Got you thanks a lot :)