How to event break with by request ID?

[baljkastr]

On my attached picture these many events should become one event by ID instead of so many, how can I break those events by ID.

ID is on first line "DRCProvision-[1663729240506]" like this

[bowesmana]

You can combine those in the search with

| rex field=_raw "DRCProvision-\[(?<ID>\d+)\]"
| stats list(_raw) by ID

but if you want to combine those at ingest time, that's a more complex task and I'm not sure how you could achieve that.

The rex statement will extract the ID from the event and the stats command will put all events to a single new event.