Not sure we have it out of the box in any of the power-ups, but you can fairly easily extract all events as a JSON in a custom action and search through those...

Essentially I see two options here:





If I may add, I believe having the [0] means we are dealing with a potential list of values. If it cannot occur for you, then what I have to say is irrelevant. If you have a list of values of unknown size, you are going to have, generally speaking, bad time using placehodlers, as you can only retrieve one field at a time. You should consider reaching back to Elastic(?) to retrieve the entire log, with its structure, and then you can use the expression builder to retrieve all elements of the list.