Hello,
I just want to sum it up for a better understanding.
You have pipeline that extracts 3 different parts of the string and creates three different fields?
key1: “some string”
key2: “17”
key3: “another string”
Then create a second rule to remove key2 field and then add it back to the message field?
If this is correct it seems like a lot of work.
Have you tried to create an extractor using a Regular expression?
key3=(\s*(\S+)+\s*(\S+))
Using the cut method instead of copy.
I can do simply pipeline rules but this may need someone else in the community to help out.
Also found this post.
Hope that helps