Thx fpr your answer. Support told me that, too. But unfortunately I have to handle a bunch of different event formats (some of them XML). They are all wrapped in a message which I tried to remove with this approach.
But even if it would work, there are a lot more problems:
- export still uses the raw format
- field extraction dialog uses the raw format
- and a lot more
So we ended up stripping the message part from the event and put everything we need from it (basically meta data) into indexed fields.
... View more