Nobody is going to be able to answer your question or even give you much help unless you provide a great deal more detail, including samples of your existing data and a mockup of your desired final state.
Assuming this is your regex for the field:
then I would do
....| regex field=_raw "\nBody:\s(?<new_raw>[^\}]+)" | eval _raw=new_raw
please note that pre-extracted fields such as host, _time, sourcetype will still be there. you can always see time of the event even if it doesn't exist in new_raw.
If you want to index from HF on this way, this will require you props.conf and transforms.conf. But that's not the question after all 🙂
You can use route and filter on HF. Refer below data:
If you want to Anonymize you can use