@prashant_kumar_  use this transforms [hostoverride] REGEX = hostname\"\:\"(.*)\" DEST_KEY = MetaData:Host FORMAT = host::$1 props.conf  [override] TRANSFORMS-ooo = hostoverride INDEXED_EXTRACTIONS = json DATETIME_CONFIG = CURRENT LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true disabled = false pulldown_type = true my test file  {"geo":"NA","city":"UK","country":"London","hostname":"lp5cd8213yt4"}      ... View more

Thanks @niketnilay  for this walkthrough ... View more

You can used spath also.You will get two fields.Use eval to concatenate the two fields. ... View more

If you are explicitly looking for faultstring tag only then the following regex should work. (?.*)<\/faultstring> ... View more