user field is already present in data, but it is giving the wrong info, I want to extract the user field from raw logs.
Field name should be "user"
The field name "user" which I extracted is not showing up in Interested fields as the field name user is already auto extracted.
May I know how to make my extraction work with the field name "user"
Please tell us more. Are you trying to extract the field at search time or index time? How is the already-present field extracted?