Grok pattern (regex) to filter data from nested brackets

Question

I've tried to apply grok pattern to filter nested brackets in the logs which is as below,

[2022-05-20T02:21:54.715] [INFO] [{"id":"876g4jd8v36w0dhna2","data":"fetching public base-plans ..."}]

My grok pattern looks like this. But here, I'm unable to parse nested brackets (brackets inside brackets). Any help is much appreciated, since I'm trying this for long.

\[%{TIMESTAMP_ISO8601:time}\] \[%{WORD:logLevel}\] \[%{DATA:id}\]

sudhagar ramesh · Accepted Answer · 2022-06-07 05:10:01Z

1

This will be working fine.

\[%{TIMESTAMP_ISO8601:time}\] \[%{WORD:logLevel}\] \[\{\"%{GREEDYDATA:id}\"\}\]

edited Jun 7, 2022 at 5:10

answered May 20, 2022 at 12:38

sudhagar ramesh

1242 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Naveen · Accepted Answer · 2022-05-20 13:18:59Z

0

Below is working fine and will filter as expected (regex)

filter {
  grok {
    match => { "message" => "\[%{TIMESTAMP_ISO8601:time}\] \[%{WORD:logLevel}\] \[\{\"id\":%{DATA:id},\"data\":%{DATA:response}\]"}
  }
}

answered May 20, 2022 at 13:18

Naveen

1451 gold badge4 silver badges15 bronze badges

Collectives™ on Stack Overflow

Grok pattern (regex) to filter data from nested brackets

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related