I needed to do the same thing and this is how I did it:
Edit Query
Click ‘Transform’ tab (search in browser if you don’t see it)
Click ‘Add transformation’
Choose ‘Rename by regex’
I had a string like this: host:traffic.non_negative_derivative {host: 10.0.2.57}
and wanted just the IP address, so here is the regex I used for the Match: .*host\:\s(.*)\}$