I am pretty close with extracting the ORA error out of the message field. However the field created has the dash ORA-. I want to name the field something else. For example ORA_err.
match => [ "message", "(?ORA-[0-9]*)" ]
How would I go about doing this?