I would like to move val2 from second row to first row and show just one row for this @timestamp value. There are have same @timestamp value.
What I have for now
| @timestamp | id | value1 | value2 |
|---|---|---|---|
| 2022-02-04T12:21:51.085+03:00 | test-id | val1 | |
| 2022-02-04T12:21:51.085+03:00 | val2 |
What I expect:
| @timestamp | id | value1 | value2 |
|---|---|---|---|
| 2022-02-04T12:21:51.085+03:00 | test-id | val1 | val2 |
Here is my query:
fields @timestamp, @message
| parse @message /-(?<requestId>([A-Za-z0-9]{5,})).*id=(?<id>[^,]+).*x-value1=(?<value1>([A-Za-z0-9-_,()!@#$%<>:*?\s]+[.]{1}[A-Za-z]{3,4}))/
| filter strcontains(@message, 'x-value1=') or strcontains(@message, concat(requestId, ') Method request body before transformations: {'))
| parse @message "Method request body before transformations: {*}" as value2
| display @timestamp, id, value1, value2
