You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To my understanding there is no access to the original raw input text? I had a use case where I had the need to pick some values out of the lines and produce output with those fields and the raw input
As a simple example transform timestamp debug 100ms john <rest of the line>
to 100 john timestamp debug 100ms john <rest of the line>
where the 100ms and the username where picked from the line and then printed with the original line.
Could be as simple as just having access to field _raw that would contain the original input.
Just realised that one can do this agrind '* | * as raw'
to achieve that. I think automatic access to the _raw would be good feature anyway.
The text was updated successfully, but these errors were encountered:
To my understanding there is no access to the original raw input text? I had a use case where I had the need to pick some values out of the lines and produce output with those fields and the raw input
As a simple example transform
timestamp debug 100ms john <rest of the line>
to
100 john timestamp debug 100ms john <rest of the line>
where the 100ms and the username where picked from the line and then printed with the original line.
Could be as simple as just having access to field
_raw
that would contain the original input.Just realised that one can do this
agrind '* | * as raw'
to achieve that. I think automatic access to the
_raw
would be good feature anyway.The text was updated successfully, but these errors were encountered: