i want make three new field that capture alert, source address and destination address from message field. anyone can help me how to do it. i have try using runtime field, but i cannot extract the value from the message using
emit(doc['message'].value) and getting
match_only_text fields do not support sorting and aggregations error.