How to cut data to fourth character "|"?

[Luninho]

I want to cut data that goes up to the fourth symbol "|". How can i do it through | rex?
Example data:
2022-12-15 15:27:38.073 - INFO | TID = 1878892572955613 | reactor-http-epoll-36 | x.x.x.x.xxxxx.xxx.xxxClient | Response from url=https://xxxxxxxx:8081/xxxx xxxx xxxxxxxx

2022-12-15 15:27:38.082 - INFO | TID = | http-xxx-8080-xxxx-100 | r.n.m.d.d.l.i.util.InfoLoggingUtil | xxxMethod xxxxxx xxxxx {Parsed: bytes=276 | xxxxxxxxMethod.xxxxxxxxMethodData="eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6ImY3YzIwZTI4LTAzMTctNDFmYS1hZTU5LTkyMzdkZmY4YmNjZCIsInRocmVlRFNNZXRob2ROb3RpZmljYXRpb25VUkwiOiJodHRwczovL3BheW1lbnRjYXJkLnlvb21vbmV5LnJ1OjQ0My8zZHMvZmluZ2VycHJpbnQvbm90aWZpY2F0aW9uLzI3OS9ZR3JmQ21pUS1MdUg1cTFHX2xQTzNLNGFHTzhaLi4wMDIuMjAyMjEyIn0=" | xxxxxxxMethod.param=""}


I want:
 Response from url=https://xxxxxxxx:8081/xxxx xxxx xxxxxxxx

 xxxxxxxxMethod.xxxxxxxxMethodData="eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6ImY3YzIwZTI4LTAzMTctNDFmYS1hZTU5LTkyMzdkZmY4YmNjZCIsInRocmVlRFNNZXRob2ROb3RpZmljYXRpb25VUkwiOiJodHRwczovL3BheW1lbnRjYXJkLnlvb21vbmV5LnJ1OjQ0My8zZHMvZmluZ2VycHJpbnQvbm90aWZpY2F0aW9uLzI3OS9ZR3JmQ21pUS1MdUg1cTFHX2xQTzNLNGFHTzhaLi4wMDIuMjAyMjEyIn0=" | xxxxxxxMethod.param=""}

[yuanliu]

For rigid format like this, it's better to not use rex at all; use split and mvindex instead.  Both semantically direct and more performant.

| eval past4th_pipe = mvindex(split(_raw, "|"), 5, -1)

[gcusello · Accepted solution]

Hi @Luninho,

I suppose that you want to take only a part of event at search time not at index time, in this case you have to use a regex like this:

| rex "^([^\|]*\|\s+){4}(?<message>.*)"

that you can test at https://regex101.com/r/M6OLte/1

ciao.

Giuseppe

[gcusello]

Hi @Luninho,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉