As a matter of fact, one actually doesn't need to specify the field name, which contains all the key value pair. I used following simple extract parameters: | extract pairdelim="," kvdelim=":" One doesn't need to escape "," as done in the first answer! ... View more