[brudgers]

If it were my problem, I'd probably start by normalizing the log files after the log files were produced. Which is to say, I'd start by writing a program to normalize the log files rather than modifying the programs producing the log files.

The reasons I'd approach it that way is it would decouple the process of designing a new log format from the process of refactoring all the code generating the logs. At the point where I knew what was worth doing and could come up with a plan for doing it before touching all the components. Then I could implement changes as it made sense rather than all at once.

Good luck.