How to create multivalue field with regex?

[tgdvopab]

Hello

I want to push values into a multivalue field.

The raw data are looking like the following:

Sep 6 14:27:56 This is a test from admin@chip.de to_address: test1@chip.de, test2@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to_address: test1@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to_address: test1@chip.de, test2@chip.de, test3@chip.de, info@web.com

Now I want to push all email addresses after the to_address into a multivalue field.

Does anyone know, how to achieve this?

Thanks

[Nicolo_Figiani]

Hello,
in order to have a multivalue field from the regex, make sure to tweak the fields.conf as well:

TOKENIZER =
Use this setting to configure multivalue fields. A regular expression that indicates how the field can take on multiple values
at the same time. Otherwise, the first group is taken from each match to form the set of
values.

More info in the docs: fields.conf spec

Hope it helps, regards..

[sundareshr]

Try this

... | rex "to_address\:\s(?<to>.*)" | makemv to delim=", "