We have events where some fields are having multiple value , below is the example
Thanks In advance
if you have only three fields with the possibility that the second one (email) could have more values, or, in a more general use case, you have only one field that could have more than values and this field is an email, you could use three different regexes for the three fields:
| rex "^(?<id>[^,]*),"
that you can test at https://regex101.com/r/MtUP2K/1
| rex max_match=100 ",(?<email>[^@]*@[^,]*),"
that you can test at https://regex101.com/r/MtUP2K/2
| rex ".*,(?<name>.*)$"
that you can test at https://regex101.com/r/MtUP2K/3
The no of fields isn't a problem for this approach, the mandatory rules are:
Anyway you can put them in props.conf, otherwise (as a workaround) you can put in props all the other fields and use rex command only for the multivalue field.