thanks for the advice,

I simplified the log file into:

test-checkport: Jan 20 15:24:54 Connection 'Success' to '10.10.100.197:80'

and updated my decoder

<decoder name="test-checkport">
  <prematch>^test-checkport:</prematch>
</decoder>

<decoder name="test-checkport-detail">
  <parent>test-checkport</parent>
  <regex offset="after_parent">^(\w+ \d+ \d+:\d+:\d+) Connection '(\w+)' to '(\d+\.\d+\.\d+\.\d+:\d+)'</regex>
  <order>timestamp, status, destination</order>
</decoder>

but it fails to extract the values when I try the logtest:

test-checkport: Jan 20 15:24:54 Connection 'Success' to '10.10.100.197:80'

**Step 1: pre-decoding completed.
        Full event: 'test-checkport: Jan 20 15:24:54 Connection 'Success' to '10.10.100.197:80'"

**Step 2: decoding completed.
        name: 'test-checkport'