Question 108268 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – Grok pattern (regex) to filter data from nested brackets

I’ve tried to apply grok pattern to filter nested brackets in the logs which is as below,

[2022-05-20T02:21:54.715] [INFO] [{"id":"876g4jd8v36w0dhna2","data":"fetching public base-plans ..."}]

My grok pattern looks like this. But here, I’m unable to parse nested brackets (brackets inside brackets). Any help is much appreciated, since I’m trying this for long.

[%{TIMESTAMP_ISO8601:time}] [%{WORD:logLevel}] [%{DATA:id}]
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Below is working fine and will filter as expected (regex)

    filter {
  grok {
    match => { "message" => "[%{TIMESTAMP_ISO8601:time}] [%{WORD:logLevel}] [{"id":%{DATA:id},"data":%{DATA:response}]"}
  }
}

  2. 0

    This will be working fine.

    [%{TIMESTAMP_ISO8601:time}] [%{WORD:logLevel}] [{"%{GREEDYDATA:id}"}]

    grok pattern

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search