We automatically detect common formats using regex during ingestion. Many are based on logstash patterns and we have several of our own (including one that just tries to strip out timestamp + log level). If you use a common format, we can usually add it. If you have a custom format that your app defines, we don't have a way for you to add it yet but it'll likely be a regex as you said. (We can always help you create it if you don't want to).