Extract into json objects together with the other _raw.items and rename the field

It looks like body has some Key:Value pairs.Have you tried using a Parser() function w/source field of _raw and Type of Delimited values?Where delimiter is `:`.

Regex is better for that use case

<@U027KUMV39P&gt;

I'm glad you posted that <@U01C35EMQ01&gt;. I will be needing that in the future. It's very similar to Splunk's method, so I'm glad to see it's available the same way. :slightly_smiling_face: :skin-tone-2:

Thanks <@U01C35EMQ01&gt;. I tried the solution, but get KEY_0: {"body" as an output

I Dm'd you a zoom

sure

The world would be a better place with nicely formatted input. I don't think that David has met a poorly formatted input that he could not tame with Stream.

All fixed!