07 Aug 2023 01:36 PM
I am trying to add field to the log viewer using log processing rule. I am able to add the field using
PARSE(content, "JSON{STRING:message}(flat=true)")
| FIELDS_ADD(message:message)
In log viewer message field is showing at the last column. I want to specify the column or position at which this field to be added. I have looked at the FIELDS_ADD command but not able to figure out how to specify position
FIELDS_ADD( [ alias':' ]
{ *
| alias.*
| '@'position
| function
| expression
| literal
}
[ , ... ]
)
Just looking for an example of how add field position
12 Aug 2023 10:29 AM
Hi @adeeb,
would you please provide a sample from the JSON? As far as I know that you can add the fields to be parsed and according to the ordering of the added fields you should have the same ordering in the result.