I have a log in which variations of case on the fieldname are causing automatic field extraction to create several fields where I would like only 1.
With entries like the following in the loglines:
I would like to get only one case insensitive field extracted that collapses them all as "requestor_id"
The automatic field extractor was treating each case variant as a separate field. I setup a saved field extraction that was case insensitive and was able to give me one "good" field extraction that contains all of the data. However, the other case variants for the field name in the logs are still being extracted as well, and that's confusing to users.
Is there a way to tell automatic field extraction to NOT proceed with auto-extracting on the redundant field names (requestor_Id, Requestor_ID) so that only my one case insensitive field extraction called requestor_id is presented?