That is correct, I am parsing a different message than the incoming one  I am parsing the json that is in message, but that one contains a field called "Message" . I have already started renaming my error flags after trying to find out why it was sh...

Hi @Dimarsky, any chance this will make it to a next release? I can work around it by doing this:grok { match => {"Message" => ["Action Group:%{DATA:action_group}\\r"]} on_error => "_grok_message_failed" } grok { match => {"Message" => "Authorization...

Hi there!As said in the other post: the array_function defines how it needs to process a json array see this page for an example: https://cloud.google.com/chronicle/docs/reference/parser-syntax#manipulating_json_arrays You normally build up a parser ...