Nobody is going to be able to answer your question or even give you much help unless you provide a great deal more detail, including samples of your existing data and a mockup of your desired final state.
Assuming this is your regex for the field:
...|rex "\nBody:\s(?<_raw>[^\}]+)"
then I would do
....| regex field=_raw "\nBody:\s(?<new_raw>[^\}]+)"
| eval _raw=new_raw
please note that pre-extracted fields such as host, _time, sourcetype will still be there. you can always see time of the event even if it doesn't exist in new_raw.
If you want to index from HF on this way, this will require you props.conf and transforms.conf. But that's not the question after all 🙂
can you provide sample events and what is expected output?
it seems previous comments are deleted :
have you tried:
...|rex "\nBody:\s(?<_raw>[^\}]+)"
I asked you how we can rewrite event at HF level, so that data come only having Body data.
You are giving me query I gave you 😄
You can use route and filter on HF. Refer below data:
http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad
If you want to Anonymize you can use SED-CMD
https://docs.splunk.com/Documentation/Splunk/7.0.2/Data/Anonymizedata