We can use a custom separator for structured messages

systemd-journal-gelf

@@ -115,11 +115,19 @@ while ( my $entry = <JOURNAL> ){
     level          => $msg->{PRIORITY}
   };
 
-  # Now lets look at the message. If it starts with gelf: we can split it and have further
+  # Now lets look at the message. If it starts with gelf: or gelf(<separator>):
-  # fields to send. I use this to handle httpd or nginx logs for example
+  # we can split it and have further fields to send.
-  if ( $msg->{MESSAGE} =~ m/^gelf:([a-zA-Z\d]+=([^\|])\|?)+/ ){
+  # I use this to handle httpd or nginx logs for example
-    $msg->{MESSAGE} =~ s/^gelf://;
+  # If separator is not specified, the default is | eg
-    foreach ( split /\|/, $msg->{MESSAGE} ){
+  # gelf:code=200|url=/index.html|remote_ip=10.99.5.12|referer=http://test.local/
+  #
+  # OR
+  #
+  # gelf(~):code=200~url=/index.html~remote_ip=10.99.5.12~referer=http://test.local/
+  if ( $msg->{MESSAGE} =~ m/^gelf(\([^\(\)]+\))?:([a-zA-Z\d]+=([^\|])\|?)+/ ){
+    $msg->{MESSAGE} =~ s/^gelf(\([^\(\)]+\))?://;
+    my $separator = ($1 && length $1 > 0) ? qr{$1} : qr{\|};
+    foreach ( split /$separator/, $msg->{MESSAGE} ){
       my ( $key, $val ) = split /=/, $_;
       $gelf->{'_' . lc $key} = $val;
     }