Not sure if I completely understand the question b/c you say there are 3 different patterns but then you give the format you're trying to capture. But give this a shot....
Try using a props/transforms combo like this:
props.conf
[sourcetypeName]
REPORT-getData = getLogData
transforms.conf
[getLogData]
DELIMS = "|"
FIELDS = MsgID, DateTime, MessageType, Icon, Message, ObjectType, ObjectID, ObjectID2, IPAddress, Caption, BackColor, Acknowledged, ActiveNetObject, NetObjectPrefix
You can then search by each name in the 'FIELDS' section and I believe you'll be good-to-go.
... View more