Hello, I'm trying to show this event as a table:     2021-05-04 11:28:56.722, TIME="2021-05-04 11:28:56.722", ID="0a7a270b79341ba28179372363920a5d", CREATED="1620127736722", SOURCE="Group Aggregation", ACTION="entitlement_attribute_change", TARGET="CN=g-cvi_admin_test,OU=CVI,OU=Security,OU=Control Groups,DC=base,DC=dev", APPLICATION="AD Base Direct", ACCOUNT_NAME="memberOf", INSTANCE="003608aa42a7425793ea73cc7f9f8e65", ATTRIBUTE_NAME="msDS-PrincipalName", ATTRIBUTE_VALUE="BASEDEV\g-cvi_admin_test", ATTRIBUTES="<Attributes> <Map> <entry key="attributeName" value="msDS-PrincipalName"/> <entry key="newValue" value="BASEDEV\g-cvi_admin_test"/> <entry key="oldValue" value="BASEINT\g-cvi_admin_test"/> </Map> </Attributes> ", STRING1="Change of group of value CN=g-cvi_admin_test,OU=CVI,OU=Security,OU=Control Groups,DC=base,DC=dev on AD Base Direct", STRING2="BASEINT\g-cvi_admin_test", STRING3="group"     I have all the fields extracted correctly  even the ATTRIBUTES:     <Attributes> <Map> <entry key="attributeName" value="msDS-PrincipalName"/> <entry key="newValue" value="BASEDEV\g-cvi_admin_test"/> <entry key="oldValue" value="BASEINT\g-cvi_admin_test"/> </Map> </Attributes>     From this ATTRIBUTE field, thanks to:     |rex max_match=0 field=ATTRIBUTES "<entry key=\"(?<key_xml>[a-zA-Z0-9_]+?)\" value=\"(?<value_xml>[\s\S]+?)(?:\"\/>)"     From that I'm getting key_xml and value_xml as multivalues. I would like to have key_xml as column names and value_xml as row cells of the corresponding keys. Thanks to whomever can help me   ... View more