Nobody is going to be able to answer your question or even give you much help unless you provide a great deal more detail, including samples of your existing data and a mockup of your desired final state.
Assuming this is your regex for the field:
then I would do
....| regex field=_raw "\nBody:\s(?<new_raw>[^\}]+)" | eval _raw=new_raw
please note that pre-extracted fields such as host, time, sourcetype will still be there. you can always see time of the event even if it doesn't exist in newraw.
If you want to index from HF on this way, this will require you props.conf and transforms.conf. But that's not the question after all 🙂
You can use route and filter on HF. Refer below data:
If you want to Anonymize you can use