How can I exract these error messages into one field?

[karthi2809]

|| vasb05 | PROD | Availit | | 2017-08-11 08:54:01,420 | ERROR | http--10.100.108.48-8080-13 | com.amerigroup.utilities.FileTransferManager.saveFile(FileTransferManager.java:120) | Unable to write file data to \agpcorp\apps\Local\BatchJava\Prod\attachments\ClaimAppeals\144603114500_20170811T085401_1_CLAIM.pdf: java.io.FileNotFoundException: \agpcorp\apps\Local\BatchJava\Prod\attachments\ClaimAppeals\144603114500_20170811T085401_1_CLAIM.pdf (There is not enough space on the disk)

italic field to extract

[DalJeanis]

At search time, do this...

| rex "(|[^|]*){6}| ERROR\s+(|[^|]*){2}|(?<errormessage>.*)"

[richgalloway]

Do you want to extract the fields at index time or search time?