Here is what worked for me: | makemv tokenizer="([^,]+)," Params | mvexpand line | rex field=Params "(?<key>[^{:]+) : (?<value>[0-9]+)" ... View more

I have a similar situation and this answer doesn't work for me. How does the extract command know to work on the Params field? It's not mentioned anywhere ... View more