You may use the following custom decoder to extract all fields:
<prematch>^\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d [\d+]\s+\w+\s+\w+\s+- </prematch>
<regex>^(\d\d.\d\d.\d\d\d\d \d\d:\d\d:\d\d.\d\d\d) [(\d+)]\s+(\w+)\s+(\w+)\s+-\s+(\.+):\s+(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+),(\S+)</regex>
Where the fields you mention are extracted as
field8 respectively. If you don't wish to extract the other fields you may remove their parenthesis on the
<regex> tag and their names from the
The result of running your log through the
wazuh-logtest utility after configuring this decoder in
**Phase 1: Completed pre-decoding.
full event: '14.07.2021 12:11:31.801  info MainForm - Database(s) loaded: CA_2021,beforetest,FL_2,FL_Jan_2021,jhon,DC_City_Jan_2021,Statetest,Benchmark_2021'
**Phase 2: Completed decoding.
decoded.action: ' Database(s) loaded'
decoded.date: '14.07.2021 12:11:31.801'