Tom, one more: If you can't get the log format changed at the source to something a bit more convenient, you can do something like this at search time: <yourSearchForEvents> | rex "Response: (?<responseComponent>.+)" | spath input=responseComponent Assuming your response message always starts with "Response: ", there is only one such string in each event and the Response is everything from there to the end of the line, it will pull out the whole response message and store it in a field called responseComponent. The following spath command will then take every element of that responseComponent (valid JSON) and convert it into a field/value pair. Field names will be the element names from the response. So, you should have three fields (given your example message): If the response contains more than three elements, you'll see the additional fields as well. ... View more