I would extract a substring from field for example
I have this field
type=USER_AUTH msg=audit(155558731.704:1977444): pid=126 uid=0 auid=42949672915 ses=42945 msg='op=PAM:authentication grantors=pam_unix acct="rodrigo.adsa" exe="/usr/sbin/sshd" hostname=baseserver addr=22.214.171.124 terminal=ssh res=success
I would to create SUB field for exemple
I know that it's possible made this from "script field" and also with GROK INGEST
Which is the best solution
How I can do this?