Can't parsing 00 as number

Elastic Stack Elasticsearch
1

I have a log like this:

2024-08-05T15:21:55.061+07:00 X-Request-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx trace-id=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx span-id= INFO 1 --- [nio-8080-exec-8] i.c.p.logging.LoggingServiceImpl : RESPONSE method=[POST] path=[/xxxx/v1/inquiry/xxxxxx] responseHeaders=[{X-Request-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, X-Correlation-ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}] responseBody=[{"responseCode":"00","responseDesc":"Approved","data":[{"branch":"X","channelId":"xxxx","clientId":"xxxx"}]}]`

This is a sample log with the data obfuscated. When the responseCode is not "00", it is successfully parsed. However, when the responseCode is "00", it returns a value of "-". I would like it to return the actual value, which is "00".

2

Hello,

You need to provide a lot more of context.

What is not being parsed? How are you parsing it? Are you using Logstash? Are you using Elastic Search Ingest pipelines?

Please share this information.

3

Sorry for the lack of clarity. I'm using Logstash, and here is the filter I'm using.

match => ["message", "%{TIMESTAMP_ISO8601:timestamp} X-Request-ID=%{UUID:x_request_id} trace-id=%{DATA:trace_id} span-id=%{DATA:span_id} +%{LOGLEVEL:log_level} %{NUMBER:pid} --- \[%{DATA:thread_name}\] %{DATA:class} *: %{WORD:log_type} method=\[%{WORD:method}\] path=\[%{NOTSPACE:path}\] responseHeaders=\[\{%{DATA:responseHeaders}\}\] responseBody=\[%{DATA:responseBody}\]"]

grok { match => { "responseBody" => "responseCode":"%{NUMBER:responseCode}","responseDesc":"%{DATA:responseDesc}","data":%{GREEDYDATA:data}"} } }