Exclude ordered list numbers while parsing

Hi all,

I have 1. StartTime:3761976079 to be parsed, it may have leading and trailing spaces. I am using this grok expression to parse ^(?<key>[^:]+):\s*%{GREEDYDATA:value}. How do I exclude the number at the start? Current output "1. StartTime":"3761976079", Expected output "StartTime":"3761976079".

Any help is appreciated. Thanks

INPUT: 1. StartTime:3761976079
OUTPUT:
{
"StartTime": "3761976079"
}

GROK:
^[0-9]{1,}[.] StartTime:%{GREEDYDATA:StartTime} or ^[0-9]{1,}\. StartTime:%{GREEDYDATA:StartTime}

The key can be dynamic, hence I need to extract the "key" separately.

So you want it to be:
{
"key":"1",
"StartTime": "3761976079"
}

?

No,
{
"key":"StartTime",
"value":"3761976079"
}

Try that:

  1. StartTime:3761976079
  2. Helloworld:3761976079

^[0-9]{1,}.\s%{DATA:key}:%{GREEDYDATA:value}$

{
"value": "3761976079",
"key": "StartTime"
}
{
"value": "3761976079",
"key": "Helloworld"
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.