I'm using custom delimiters to extract fields from the logs of a rails app. Following the advice of an answer on this site (not enough rep to link), my query looks like this: index="product" sourcetype="app" status=200 | extract pairdelim=", }{", kvdelim="=>", auto=f A log message looks like this: UserController -- Completed #index -- { :action => "index", :db_runtime => 54.64, :format => "HTML", :method => "GET", :mongo_runtime => 0.0, :path => "/users", :status => 200, :status_message => "OK", :view_runtime => 709.88 } The delimiter seems to work, because when I remove "status=200" from the query, it returns results with the fields as expected. However, when I click "Add to search" for a value where status was 200, it puts the condition in the query as shown above and returns no results. My suspicion is that the condition will need to be added in another pipe command. Can someone point me in the right direction? ... View more