My sample events look like this , API logs   { location: Southeast Asia, properties: { backendMethod: GET errors: [ {some huge nested object}, {some huge nested object} ] } }   I want to search only the events with the "errors" field. If the API is successful, it does not have this "errors" field, and I don't want to search them. I have tried {baseSearch}  | where mvcount('properties.errors') > 0 , this return nothing {baseSearch}  | where mvcount("properties.errors") > 0 , returning even the events without the "errors" field {baseSearch}  | where isnotnull('properties.errors'), this return nothing {baseSearch}  | where isnotnull("properties.errors"),returning even the events without the "errors" field {baseSearch}  |  "properties.errors"=*.  ,  this return nothing I just need something simple like {baseSearch}  |  where exist(properties.errors), what is the most simple way ... View more

Sample event   { durationMs: 83 properties: { url: https://mywebsite/v1/organization/41547/buildings } correlationId: e581d476-fa5f-4023-a53e-53d6e06734ae }   I want to replace the ids into https://mywebsite/v1/organization/{id}/buildings I tried {base search string} | eval endpoint=replace(properties.url, "\d+", "{id}") | stats by endpoint  This return no result, but if I try other coorelationId field on the root level, {base search string} | eval endpoint=replace(coorelationId, "\d+", "{id}") | stats by endpoint   This return what I expected endpoint                   |   (other fields) adb{id}f{id}-{id}fd{id}-{id}-a{id}b-{id}c{id}f{id}d | (other fields) aea{id}e{id}c-fcdc-{id}-a{id}-{id}a{id}bfe{id}ee{id} | (other fields) Why replace doesn't work on nested field? ... View more