How to save extracted data to message

Is it possible somehow to save the extracteddata to the message if the data changes dynamically. For such purposes, I used the pack stage - but I have no way to specify the labels that need to be added using pack, so the data can change.

The question is caused by parsing windows events, since different events contain different fields and it is very difficult to describe it in the pack stage. As I see in --inspect - the data is parsed, but it needs to be saved somehow.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.