Exclude ordered list numbers while parsing

#1

Hi all,

I have 1. StartTime:3761976079 to be parsed, it may have leading and trailing spaces. I am using this grok expression to parse ^(?<key>[^:]+):\s*%{GREEDYDATA:value}. How do I exclude the number at the start? Current output "1. StartTime":"3761976079", Expected output "StartTime":"3761976079".

Any help is appreciated. Thanks

(Charlie) #2

INPUT: 1. StartTime:3761976079
OUTPUT:
{
"StartTime": "3761976079"
}

GROK:
^[0-9]{1,}[.] StartTime:%{GREEDYDATA:StartTime} or ^[0-9]{1,}\. StartTime:%{GREEDYDATA:StartTime}

#3

The key can be dynamic, hence I need to extract the "key" separately.

(Charlie) #4

So you want it to be:
{
"key":"1",
"StartTime": "3761976079"
}

?

#5

No,
{
"key":"StartTime",
"value":"3761976079"
}

(Charlie) #6

Try that:

  1. StartTime:3761976079
  2. Helloworld:3761976079

^[0-9]{1,}.\s%{DATA:key}:%{GREEDYDATA:value}$

{
"value": "3761976079",
"key": "StartTime"
}
{
"value": "3761976079",
"key": "Helloworld"
}