Extracting the field
Select an event of the type shown above and expand it, then select extract fields from the event actions dropdown menu. Pick regular expression and highlight the intended session_id field, calling it session_id. from there you can validate and confirm this field.
Ordering a table
You can pipe all the events into a table command and then a sort command on session_id,
such as events| table _time, uri, ...., session_id |sort session_id
... View more