I have a requirement to match a string out the log, say 'ABC123' or 'XYZ456'.
Once this is identified, I want to assign this string into the output field. How can I do it? I can obviously use add_field with the hardcode value, but it will be tedious to do so and end up with many grok statement. Any better way?