Extracting JSON and Parsing it

I have a JSON log that comes to Logstash.
It looks like this:


Which is basically [{SOMEJSON}][{MOREJSON}]

I was thinking to do a patter where I grab the first "[" then I do %{GREEDYDATA:firstjson} until the ]. The simply repeat the procedure.

I was not successfull in making this happen

That approach should work. What did you try, exactly?

To be honest I am stuck at the start. How do I start with the character '['. and end it with ']'

This line:

grok {
match => { "message" => "[%{GREEDYDATA:firstjson}]"}
Takes it all. It does not stop at the ]

match => { "message" => "^\[%{GREEDYDATA:firstjson}\]$"}

I'd expect it to be faster to use a mutate filter and its gsub option to remove leading and trailing square brackets.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.