How to create raw field?

[bosseres]

Hello everyone,

I have next one task: I want to collect (with collect command) information which I got after stats. Problem is that there is empty _raw field, and I don't want to add _raw in stats (because of heavy search)

So, now I have such search:

....
| stats ...
...
| table ...
| collect index=test

I need the _raw field before collect to apply to it rex sed command. 

I know that collect creates raw field even if it doesn't exist. If there are any other ways to create it? Thank you.

[gcusello]

Hi @bosseres,

usually _raw isn't a field stored with collect command.

But if you have, in the collect fields, information do exactly define the _raw event (or events), you could create (in dashboard) a drilldows feature to display (from the index) only the _raw events interested to a selected raw in stats.

this is the approach used in ES where you have Correlation Searches that contain only the data relevant for the alert, then for each of them you can define a drilldown search that takes raw data from the index related to an alert using the information in the Correlation Search.

Ciao.

Giuseppe