Hi if reference is always here, you could try this   index=_internal | head 1 | eval _raw="reference = 205, \\\"sample\\\":12345678, \\\"logic\\\":\\\"AB000012\\\", \\\"status\\\":0, \\\"result_message\\\":null, \\\"end_time\\\":null," | rex "reference\s+=\s+(?<reference>\d+),\s+(?<json>.*)" | rex mode=sed field=json "s/\\\\\"/\"/g" | rex mode=sed field=json "s/(.*),$/{\1}/" | spath input=json | table reference json sample logic status result_message end_time   Now it takes reference out and then transfer rest of event to json. Then You can manage individual elements after spath command as you want independent what are those names. This expecting that there is "," on last character on event. If not then you must change that last rex command to handle those. r. Ismo ... View more