Hi @subspacefield , if that is exactly how you have in your search then there are 2 issues. for rex - you need to tell it what to look at:  Rex works as you would read something - when extracting you need to extract in the order things appear in the data. Yours rex command:   | rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)" Corrected rex command:   | rex field=_raw "CurrentOffset:(?P<CurrentOffset>\d+) MessagesToConsume:(?P<MessagesToConsume>\d+)" When working with issue like this, regex101.com is your best friend:  https://regex101.com/r/4CkJF0/1 ... View more