Java Splunk Best Logging Format

Question

I am trying to implement some logging in my application and have been reading online on best practices. Splunk recommends using key value pairs but that can look ugly. Is it better to have logs based on columns or key value pairs?

Column based logging (1st column is time, 2nd column is thread name, etc):

2017-02-15 17:22:55,754 [main] DEBUG com.stackifytest.logging.FooFactory: Creating a Foo

Or key value pairs:

2017-02-15 17:22:55,754 | thread=main, level=DEBUG, location=com.stackifytest.logging.FooFactory, msg=Creating a Foo

Answer 1

Splunk will most easily parse data in key-value pairs with Automatic key-value extraction