Unable to extract fields from raw logs, how can I extract fields in this case?

[POR160893]

Hi,

I have a number of raw logs that I need to extract some fields from.

When I go to "Event Actions" and then "Extract Fields", I normally get the following:

However, I am dealing with a number of logs for one index where I get this instead and I cannot extract anything:

How can I extract fields in this case?


Thanks,
Patrick

[diogofgm]

There are multiple ways to extract fields without using the interactive field extractor.
If you are comfortable with regex, You can try to use the |rex command to start building your extractions in search. After that you can just place them on a props.conf, or add them via settings >> fields >> field extractions.

If you are not comfortable with regex, you can post a sample of your data and we can help you out with that. 😉