Hi, This work when I use it at search time: | spath path=messageParts{} output=message | mvexpand message | rex field=message "{\"disposition\":\s+\"(?<disposition>[^\"]+)\",\s+\"sha256\":\s+\"(?<sha>[^\"]+)\",\s+\"md5\":\s+\"(?<md5>[^\"]+)\",\s+\"filename\":\s+\"(?<filename>[^\"]+)\",\s+\"sandboxStatus\":\s+\"(?<sandboxStatus>[^\"]+)\",\s+\"oContentType\":\s+\"(?<oContentType>[^\"]+)\",\s+\"contentType\":\s+\"(?<contentType>[^\"]+)\"}" BUT how to put this in props.conf? I have tried MV_ADD = true - but no luck   ... View more