I'm also trying to parse the FLEXlm logs but still struggling. which translates to something like this in the Field Extractor: ^(?P[^ ]+)\s+(?P< FLEXlm_Daemon>[^ ]+)\s+(?P< FLEXlm_Message>\w+:)\s+(?P< FLEXlm_Module>[^ ]+)\s+(?P< FLEXlm_User>.+) Some have a space at the beginning which throws everything off and being excluded from my searches. I found this wonderful tool which has helped with getting the regex better http://regexr.com/ (\d+:\d+:\d+)\s+([^ ]+)\s+(\w+:)\s+([^ ]+)(.+) This is not working a 100% but it's a start. Welcome suggestions on improvement others out there ... View more