Loginsight custom regex field

[Turksat_Sistem]

I have custom logs and each field seperated by a pipe character (|).  I wanted to create a custom regex field that should bring me back the 5th field.

Regex that tested in regex101.com is below and it is working fine with my log line.

^(?:[^|]*\|){5}([^|]*)

But when I use it loginsight custom field It returns unrelated fields (more that 1 pipes).

Any idea?

Log sample:

2016-08-25 10:19:29,011 INFO  [http-nio-7070-exec-710] [x.service.y]  - [#|INFO|25/08/2016 10:19:28.991|172.17.0.55|3454353453453|8.8.8.8|xyccc|1370|asdasdasd|#]

[sflanders · Accepted solution]

Pipe means "OR" in regex. You will want to escape the pipe with a forward slash "\|". I hope this helps.