Hi @gcusello , thanks for replying.  Yes, you understood my issue correctly. Actually this is almost the same solution I have right now. The only issue is I have multiple message fields, and if I run this it gives me the string of the first occurrence of message instead of the message  which matches my sub-string. For ex. this is how my event looks like:     time=2022-04-13T07:00:34,276Z traceName= correlationId= level=INFO logger=PortfolioFetcher message="Calling" source="TakeOver/file3" time=2022-04-13T07:00:34,278Z traceName= correlationId= level=INFO logger=PortfolioFetcher message="Calling" source="TakeOver/file5" time=2022-04-13T07:00:34,281Z traceName= correlationId= level=INFO logger=PortfolioFetcher message="Calling" source="TakeOver/file2" time=2022-04-13T07:00:35,213Z traceName= correlationId= level=INFO logger=DataFetcher message="Takeover process completed with 390_38 files" source="TakeOver/file1"     Now, I want to use sub string "process completed" to get string  "Takeover process completed with 390_38 files" . If you could help with this, that would be really awesome of you! ... View more