Can we add data to fields manually in a decoder or rule?

[mfsiii]

I have several different applications whose logs Wazuh is ingesting that I am monitoring for login failures. One app will say denied, one will completely change the format when successful; they all are different. To simplify this, I would like to manually add data to a field if a decoder or rule is triggered to make them all consistent. Something like data.status='successful'. I have both experimented and searched and haven't been able to find if this is possible. Thanks in advance!