Something like: index=<your index> | rex field=_raw "processor.Proc(?<new_field>[^\s]+)" | stats values(new_field) This will create a new field called "new_field" and add everything after the "processor.Proc" up until the next space. If what you're showing is a single, multilined event, then you would need to add max_match=0 to the rex command and change the "\s" to a "\n". So it would look liked: index=<your index> | rex max_match=0 field=_raw "processor.Proc(?<new_field>[^\n]+)" | stats values(new_field) Hope that helps. ... View more