Filed name = pluginText
<plugin_output>Information about this scan :
Nessus version : 10.3.0
Nessus build : 20080
Plugin feed version : 202208222232
Scanner edition used : Nessus
Scanner OS : LINUX
Scanner distribution : es7-x86-64
Scan type : Normal
Scan name : Host_Discovery & OS_Identification
Scan policy used : 93e1da98-656c-5cd5-933b-ce6665fc0486-1939724/Host_Discovery_Scan_03292022 Scanner IP : 10.102.10.1
Port scanner(s) : nessus_syn_scanner
Port range : sc-default
Ping RTT : 11.921 ms
Thorough tests : no
Experimental tests : no
Plugin debugging enabled : no
Paranoia level : 1
Report verbosity : 1
Safe checks : yes
Optimize the test : yes
Credentialed checks : no
Patch management checks : None
Display superseded patches : yes (supersedence plugin launched)
CGI scanning : disabled
Web application tests : disabled
Max hosts : 30
Max checks : 5
Recv timeout : 5
Backports : None
Allow post-scan editing : Yes
Scan Start Date : 2021/8/10 1:55 UTC
can duration : 63 sec
</plugin_output>
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row
| rex field=pluginText max_match=0 "\s*(?<namevalue>[^:]+ : .+)"
| streamstats count as _row
| mvexpand namevalue
| rex field=namevalue "(?<name>[^:]+) : (?<value>.+)"
| eval {name}=value
| fields - name value namevalue
| stats values(*) as * by _row
Thank you so much, I really appreciate it. It works perfectly.