In some of our examples, we searched for the raw word error. You may have noticed that many of the events weren't actually errors, but simply contained the word error somewhere in the message. For example, given the following events, we probably only care about the second event:
2012-03-21T18:59:55.472-0500 INFO This is not an error 2012-03-21T18:59:42.907-0500 ERROR Something bad happened
Using an extracted field, we can easily create fields in our data without reindexing that allow you to search for values that occur at a specific location in your events.
