title: Parsing a string field
body: <p>I have these Syslog messages:</p>
  
  <pre><code>N 4000000 PROD     15307 23:58:12.13 JOB78035 00000000  $HASP395 GGIVJS27 ENDED\r
  NI0000000 PROD     15307 23:58:13.41 STC81508 00000200  $A  J78036            /* CA-JOBTRAC JOB RELEASE */\r
  </code></pre>
  
  <p>I would like to parse these messages into various fields in a Hash, e.g.: </p>
  
  <pre><code> event['recordtype']  #=&gt; "N"
   event['routingcode'] #=&gt; "4000000"
   event['systemname']  #=&gt; "PROD"
   event['datetime']    #=&gt; "15307 23:58:12.13"
   event['jobid']       #=&gt; "JOB78035"
   event['flag']        #=&gt; "00000000"
   event['messageid']   #=&gt; "$HASP395"
   event['logmessage']  #=&gt; "$HASP395 GGIVJS27 ENDED\r"
  </code></pre>
  
  <p>This is the code I have currently:</p>
  
  <pre><code>message = event["message"];
  if message.to_s != "" then
    if message[2] == " " then
      array = message.split(%Q[ ]);
      event[%q[recordtype]] = array[0];
      event[%q[routingcode]] = array[1];
      event[%q[systemname]] = array[2];
      event[%q[datetime]] = array[3] + " " +array[4];
      event[%q[jobid]] = message[38,8];
      event[%q[flags]] = message[47,8];
      event[%q[messageid]] = message[57,8];
      event[%q[logmessage]] = message[56..-1];
    else
      array = message.split(%Q[ ]);
      event[%q[recordtype]] = array[0][0,2];
      event[%q[routingcode]] = array[0][2..-1];
      event[%q[systemname]] = array[1];
      event[%q[datetime]] = array[2] + " "+array[3];
      event[%q[jobid]] = message[38,8];
      event[%q[flags]] = message[47,8];
      event[%q[messageid]] = message[57,8];
      event[%q[logmessage]] = message[56..-1];
    end
  end
  </code></pre>
  
  <p>I'm looking to improve the above code. I think I could use a regular expression, but I don't know how to approach it.</p>