Field alias or batch renaming with wildcard

[mdsnmss]

So I have a JSON source that is creating array values but I am looking to get rid of a number of nested fields and make them primary. Coming in I have many fields that appear docs{}.. Using | rename docs{}.* as * at search time produces the desired results but would like a backend props/transforms solution that performs the same function. I have tried FIELDALIAS-json = docs{}.* AS * but it produces no different results. Are wildcards supported by fieldalias?

These are changing fields that I am unsure of all possible values so would like to dynamically change them to drop the specified prefix for each field. If fieldalias is not possible is there another solution possibly using REPORT and transforms? The array structure of the log appears as:

"docs":[{"<field1>":<value1>,"<field2>":"<value2>",...etc.}]

[somesoni2 · Accepted solution]

AFAIK, wild cards are not supported in FIELDALIAS attribute. Try this REPORT method

props.conf

[yourSourceType]
REPORT-extractjsonfields = extract_json_fields

transforms.conf

[extract_json_fields]
REGEX = \"([^\"]+)\"=\"([^\"]+)\"
FORMAT = $1::$2
REPEAT_MATCH = true

[mdsnmss]

I should note that it is set with INDEXED_EXTRACTIONS = json so these values are all already extracted. I'd like to change them at search time. It looks like within the array the field values can have quotes or not and seems dependent on whether or not it is a string or number.

[somesoni2]

How about this?

REGEX = \"([^\"]+)\"=\"*([^\"]+|[0-9\.]+)\"*