HI team, can you please help me in extracting the field in same query for both the data. i need to get one regex or rex so i would get the cloud host and host from webserver log

[Hemant1]

I need the the instance value in single field like EU1 ,EU2,AM,AP.

host = HYBECMPRDEU1P*
host = HYBECMPRDEU2P*
host = HYBECMPRDEU3P*
host = HYBECMPRDEU4P*
host = HYBECMPRDEU5P*
host = HYBADMPRDEU1P*
host = HYBADMPRDEU2P*
host = HYBADMPRDEU3P*
host = HYBADMPRDEU4P*
host = HYBADMPRDEU5P*
host = HYBBUSPRDAMP*
host = aks-prdap-12459421-vmss000000
host = HYBBUSPRDEU1P*
host = HYBBUSPRDEU2P*
host = HYBBUSPRDEU3P*
host = HYBBUSPRDEU4P*
host = HYBBUSPRDEU5P*
host = HYBBUSPRDAMP*
host = HYBADMPRDAMP*
host = HYBECMPRDAMP*

[jpolvino]

Assuming the field you're searching in is named "host" this may work:

(your search)
| rex field=host "(PRD|prd)(?<instance>\w{2,3})"

See https://regex101.com/r/LlINs6/2