Enhanced from above idea:
| makeresults count=10
| eval _raw="{
\"contextValues\": [
\"10.1.1.1\",
\"10\",
\"testhost\"
],
\"contextTypes\": [
\"IP\",
\"threshold\",
\"hostname\"
],
\"message\": \"Latency on {hostname} with IP {IP} is higher than {threshold} ms.\"
}
"
| kv
| rename _raw AS orig_raw
| rename *{} as *
| eval temp=split("my,my,my,my,my,my,my,my,my,my", ",")
| eval _raw=mvzip(temp,mvzip(contextTypes,contextValues,"="),"_")
| kv
| fields - _raw
| foreach my_*
[ eval message= replace(message,"{"."<<MATCHSTR>>"."}",<<FIELD>>)]
| fields _time message
... View more