HI ,
please help to get new field URI by using rex
/area/label/health/readiness||||||||||METRICS|--
Hi
this should works
... | rex "(?<URI>^[^\|]+)"
I assume that your event is in _raw. If it's already in some field then just add "fields=<your field>" after rex.
https://regex101.com/r/IsMwQy/1
r. Ismo
Your question is rather vague, but assuming you want the beginning of the _raw event field up to but not including the first | you could try this
| rex "^(?<url>[^\|]+)"
