title: jq remove text before and after json
body: <p>Ingesting another sourcetype that provides insane json output. It starts out like: </p>
  
  <pre><code>Sep  1 15:52:26 | IdentityValidationApi |  |  |  | {"header":{"tenantId":"X03LHWE3","requestType":"  ...
  </code></pre>
  
  <p>and has a pipe in between the request and the response, but both are on the same line:</p>
  
  <pre><code>..."serverTime":"2017-09-01T19:52:24.641Z"}}} | {"responseHeader":{"tenantID":  
  </code></pre>
  
  <p>and the json output ends with </p>
  
  <pre><code>...,"fieldValue":"Engineer"}]}}} | D2C CrossCore Request-Response | IdentityValidationApi.corp-dev.com | /api/Inquiry | 172.30.68.88 |  | True
  </code></pre>
  
  <p>I've tried jq, using jq .header[], but it hates that | in the middle of the event. End goal is to ingest the entire event into Splunk without the beginning or end text outside the json. Can someone suggest any steps here?  Thank you.</p>
  
  <p>Edit: I can use sed to pull out the beginning of the line, but am unsure how to combine that with removing the text from the end. Can I do that?</p>