@to4kawa Initially I tried this only "| rex max_match=0 "(?<status>succeeded|failed)", I am getting bucket name and status as multi-value fields. As all I have are success events, I am not sure if mvindex(status,0) and mvindex(bucket,0) will be from same line. So, I have looked for other solutions and posed the query. Could you let me know how can we loop through an index(mvindex) from 0,1,2.... till the end. I mean mvindex(status,0) mvindex(status,1) mvindex(status,2) mvindex(status,3).... till the end of the index.
... View more