Join multiple fields and change their name

[Itai5468]

Hi everyone,

I have some data with a lot of fields.

Some fields represent the same data, but with different field names...

For example, I have 20 servers reporting their IP, with their IP as part of the field name... the value of the fields has no meaning and is insignificant.

So the data (before any queries, as it arrives) looks like this:

Server1_1.1.1.1: 2

Server2_2.2.2.2:10

Server3_3.3.3.3:1

....

Server20_20.20.20.20: 5

What I would like to do is this:

Create a new field called "Server_IP". It's Values will be all the IP addresses from the original field NAMES:

Server_IP: [1.1.1.1 , 2.2.2.2 , 3.3.3.3 ,...., 20.20.20.20]

Many thanks!

[gcusello]

Hi @Itai5468,

if the IP is in the field name, probably it's also in the _raw, so try something a regex like this:

| rex "_(?<SERVER_IP>\d+\.\d+\.\d+\.\d+)"

if you share a sample of your logs I could be more precise in the regex, in particular, it could be possible to add an additional condition before "_".

Ciao.

Giuseppe