or if you like to do more than just selecting one field, use eval: ...| eval _raw = "[" . trace_event_valid . "] " . trace_event_message EDIT: I just realized that for this example eval is a bit overkill, and strcat probably yields faster performance: ...| strcat "[" trace_event_valid "] " trace_event_message _raw any of the two would give the same example result: [NO] here a very long and complex message associated to this event ... View more