How do I make a string into a field / variable?

[hollybross1219]

Hello, my raw logs look something like this: 

Example 1:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-    2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac     class=com.intuit.fds.provider.dao.impl.EinDAOImpl Get disabled ein by ein=821570477

Example 2:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac class=com.intuit.fds.provider.service.impl.EinServiceImpl Create or update ein=821570477 einVO=EinVO [ein=821570477, active=false, einProviderRelationships=EinProviderRelationshipsVO [einProviderRelationship=[EinProviderRelationshipVO [id=null, active=null, providerId=5ece3c4d-6791-4bed-bbf5-fd9c0736c129, taxYear=2020, serviceName=W2, actualAvailabilityDate=2021-02-03T23:59:07.172-08:00, expectedAvailabilityDate=2021-02-03T23:59:07.172-08:00, preference=1, synced=false]]]]

My goal is to create a single field / variable (let's call it action_type) where the value of that field is determined by the presence of the string "Create or update" (action_type=add) or "Get disabled" (action_type=disable). 

My struggle is that these strings aren't associated with any fields, so I'm not sure how to have my eval include the LIKE function without defining a field. Please help!

My work:

[base query]

|eval action_type=CASE( LIKE(??, "Get disabled"), "disable", LIKE(??, "Create or update"), "add", 1==1, "null")

[hollybross1219]

Thank you @scelikok !!

[scelikok · Accepted solution]

Hi @hollybross1219,

You can use _raw field with match;

| eval action_type=CASE( match(_raw, "Get disabled"), "disable", match(_raw, "Create or update"), "add", 1==1, "null")