Hi,
I have Error logs which is having more than 50 lines but requirement is to be displayed for 1st 10 lines instead more than 50 and there is no common statement in each events to write it in the regex. So, Kindly help.
If your _raw string has multi line events, then this rex statement will create a new field with the first 10 lines into a new field called display
| rex "(?<didplay>((?m)^.*$\n){10})"
