Perfect. Thank you! ... View more

Thanks @richgalloway . Appreciate your help! ... View more

It sounds like you have two steps, one to extract the fields and another to display them. You can either extract the field with a value (as in my first suggestion), or without a value (as in my latest suggestion). When you come to display it in dashboard, you could change the value of the field before displaying it (eval) or remove the field from the field list (fields). ... View more

The first answer replaces (XXX) or any string I would want. I accept. However, I would have random characters before the sensitive data and not a specified character. For example: Exmaple 1) 0000|2019-01-07T14:20:12.000000Z|xxx|xxx, xxxx|xxx|M|xxx||PIEIGHT||xxx||Viewed|viewed patient data in registration(XXTEST, ORANGE CRUSH)|00000|| Example 2) 1111|2010-01-07T14:20:12.000000Z|xxx|xxx, lastname|yyy|M|xxx||PIEIGHT||xxx||error|view patient(XXTEST)|00000|| Example 3) 1234|1999-01-07T14:20:12.000000Z|xxx|xxx, xxxx|xxx|M|xxx||PIEIGHT||xxx||notviewed|search analyser (YYTEST, TEST)|00000|| a) Fields are separated using | (pipe) b) The string before (XXX) would be named as event_name.  c) Should we use captured group for building a regex? Let me know if you would need any additional info. Thank you, ... View more

Firstly, unless you have some strange linebreakers, you don't have to account for \n within the event. Secondly, if memory serves me right, within a character set you don't escape characters. So you can try with TIME_PREFIX = ^([^|]*|){5} And you need %y instead of %Y (you don't have full year number, just two last digits) ... View more