Try adding this pipe:   | rex field=id "(?<new_field_name>[^\-]*$)"   This will run a lookbehind from the last dash in the end of the string and create a new field with your new field name. In this case id is a field and the full string is that fields value ... View more