My sample event looks like below: { "thread": "http-nio-8085-exec-1", "level": "INFO", "loggerName": "INSTRUMENTATION_TRACING", "message": { "eventId": "68b3c5d3-02e5-4c33-af41-756b43fc4311", "signature": "public ResponseObj someMethod(RequestObj)", "duration": 1019, "request": [{"#my nested request Json goes here": "" } ], "response": {"#my nested response Json goes here": ""}, "endOfBatch": false, "loggerFqcn": "org.apache.logging.log4j.spi.AbstractLogger", "instant": { "epochSecond": 1561664957, "nanoOfSecond": 437000000 }, "threadId": 26, "threadPriority": 5 } I would like to display in a table like below |eventId | signature | duration | request | response Issue: I was able to extract each element in a nested JSON but the cloud is not able to aggregate 'message.request' as one JSON String Tried below : index=sample loggerName="INSTRUMENTATION_TRACING" | spath | rename message.eventId as eventId, message.signature as signature message.duration as duration , message.request as request, message.response as response | table eventId, signature, duration, request, response spath extracts all nested elements as expected. I could not see "message.request" or "message.response" in the extracted fields. I only want to extract one level (i.e I want message.request and message.response elements as Json string to display in a table) Is it possible? If so, can someone throw me some ideas, please. ... View more