If you could get the Forwarder field contains value: "123.456.78.912,+45.675.3.123,+32.123.456.55"   | rex field=forwarder "(?<numbers>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" max_match=3 max_match parameter should be maximum number since forwarder might have more than 10 values, depending on your use case. ... View more