When using the Field Extractor can you use the same name for a field? will it append or add to the original field create

Cheng2Ready — Tue, 29 Apr 2025 20:30:35 GMT

When using the Field Extractor can you use the same name for a field? will it append or add to the original field create

Example
I am extracting from the _raw data
Found that some of the _raw data didn't match when I highlight when using regex match
I was getting the red x as the example below, that should of captured it since both logs are identical in patterns.

So I extracted twice on a single field on two data sets.
will it append? And add it onto the field of data to look for?

Re: When using the Field Extractor can you use the same name for a field? will it append or add to the original field cr

livehybrid — Tue, 29 Apr 2025 20:48:52 GMT

Hi @Cheng2Ready

If you apply multiple field extractions then the one with the highest precedence will be used, instead you may wish to manually modify the regular expression to cover both events.

When extracting the fields using the field extractor wizard, on the "Select fields" step, select the "Show regular expression" text as below:

This then allows you to click "Edit regular expression" button on the right, and clicking this gives you the regex which you can override.

At this point you should define a regex that matches all the relevant events.

If you need help creating the regex please post raw examples/samples of the events and I'd be happy to help.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

topic When using the Field Extractor can you use the same name for a field? will it append or add to the original field create in Getting Data In

When using the Field Extractor can you use the same name for a field? will it append or add to the original field create

Re: When using the Field Extractor can you use the same name for a field? will it append or add to the original field cr