Exclude ordered list numbers while parsing

[Abhilash_B]

Hi all,

I have 1. StartTime:3761976079 to be parsed, it may have leading and trailing spaces. I am using this grok expression to parse ^(?<key>[^:]+):\s*%{GREEDYDATA:value}. How do I exclude the number at the start? Current output "1. StartTime":"3761976079", Expected output "StartTime":"3761976079".

Any help is appreciated. Thanks

[pastechecker (Charlie)]

@Abhilash_B

(?[^:]+):\s*%{GREEDYDATA:value}

INPUT: 1. StartTime:3761976079
OUTPUT:
{
"StartTime": "3761976079"
}

GROK:
^[1]{1,}[.] StartTime:%{GREEDYDATA:StartTime}$
or
^[2]{1,}. StartTime:%{GREEDYDATA:StartTime}$

---

1. 0-9 ↩︎

2. 0-9 ↩︎

[Abhilash_B]

@pastechecker

GROK:
^[1]{1,}[.] StartTime:%{GREEDYDATA:StartTime}$

The key can be dynamic, hence I need to extract the "key" separately.

---

1. 0-9 ↩︎

[pastechecker (Charlie)]

So you want it to be:
{
"key":"1",
"StartTime": "3761976079"
}

?

[Abhilash_B]

@pastechecker

So you want it to be:
{
"key":"1",
"StartTime": "3761976079"
}

No,
{
"key":"StartTime",
"value":"3761976079"
}

[pastechecker (Charlie)]

Try that:

13232. StartTime:3761976079
13233. Helloworld:3761976079

^[0-9]{1,}.\s%{DATA:key}:%{GREEDYDATA:value}$

{
"value": "3761976079",
"key": "StartTime"
}
{
"value": "3761976079",
"key": "Helloworld"
}