any recommendations? we need those extracted fields to be come under the event details same like below message , namespace_id , namespace_name , .....?
It's a little ugly but since the message field looks to be valid JSON, you could do this...
...
``` backup event then rename message field to _raw ```
| eval raw=_raw | rename message AS _raw
| extract ``` extract the json from _raw - n.b. it only works on _raw field ```
``` rename _raw back to message, reset _raw event back to original and remove copy ```
| rename _raw AS message | eval _raw=raw | fields - raw
by any chance if we extract field "teamName", "ID " with the rex command can come under the event that pasted in the original post just like under message , namespace_id , namespace_name , .....?
You can try to perform regex on the field to get the required values from the field. The below if a sample regex to extract the loglevel or teamName or ID. (need to optimize further accordingly.)
