Extract pairs of values multiple times but keep pairs together

[jbesant]

I have many events that look like this:

18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]

I have defined two multivalue field extractions that use a transform to repeatedly extract the Id and Place but that does not relate the Id to the Place it just returns all the IDs and the Places.

Field transform with create multivalued field ticked
mv-ID
Id: (?P[A-Z0-9@]{10})

mv-Place
Place: (?P[A-Z0-9]+)

What I want to achieve is that the extraction keeps the ID related to its Place so that when for example I search for the Id CA15000740 I only get one row returned with the Id and Place CI21 and not both Places.

index=sandbox Id=CA15000740 | table Id Place

I'm not sure if I am using the right approach with the field extraction or I need to search differently.

Thanks

[niketn]

Try the following run anywhere search based on the sample data provided. The first two pipes i.e. | makeresults and | eval _raw, generates a dummy event as per the question.

| makeresults
| eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
| rex "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s" max_match=0
| eval data=mvzip(Id,place)
| mvexpand data
| makemv data delim=","
| eval Id=mvindex(data,0),place=mvindex(data,1)
| table Id place

[FrankVl]

Is this guaranteed to respect the original ordering/pairing of the raw data?

Wouldn't it be safer to extract the whole "Id: CA15000740, Place: CI21" string into a multi valued field, then apply mvexpand and then extract the individual Id and Place fields?

| makeresults
 | eval _raw="18-Jun 10:15:21.236 [ Id: CA15000740, Place: CI21 ], [ Id: CA14105879, Place: CI22 ]"
 | rex "(?<IdPlace>\[\s[^\]]+\])" max_match=0
 | mvexpand IdPlace
| rex field=IdPlace "Id:\s(?<Id>[^,]+),\sPlace:\s(?<place>[^\s]+)\s"
 | table Id place