OK. We're starting to get somewhere, but you are making it very hard to extract a set of requirement to figure out what you want.

What you have said you want is as follows:Is that correct?

In the message I've quoted from above, you're saying that either of two outputs will be acceptable:

Code:

Critical

or

Code:

Danger

but I can't believe that is really what you want.

Please give us an exact EventMessage (in code tags) and the exact output you want to see (in code tags) for that message. And then describe the process by which you determined that was the output you wanted to extract from that message.

If you provide a list of the strings that precede the colon on a line in an event message that identify that line as an alert attribute, we can easily do that. But, with 40,000 event message types, we have no way to guess what you consider to be an alert attribute if you don't give us a description of how we determine that a line in an event message is an alert attribute.

If you want us to read event zero or more event message from standard input, we can do that too. But, you'll need something else in the output to identify the context of the message that generated the alerts. To do that you need to explicitly specify how we find the data in the event message you want printed. (Note that saying you want "ModelType={t}, ModelName={m}" doesn't help. You used that example before when talking about the sampe event message, but the strings ModelName and ModelType don't appear anywhere in that event message, and you haven't given us a clue as to how to parse the meta-notaions {t}, {m}, {I 2}, or {S 1} (although I'm making a wild guess that {I 2} means that the data for that field is a textual representation of a two byte integer value).