I've tried both, and rendering in non-XML format and filtering using the non-XML format for blacklists/whitelists, still no luck. ... View more

I think you're most of the way there.  To separate the categories, use the split function. index=my_index sourcetype=proxy_sourcetype | rex field=_raw "^("([^\"]+)",){9}"(?<categories>[^\"]+)" | eval categories=split(categories,",")   ... View more