Filtering of unusual multiline json

Hi, everyone. I have unusual log with json
INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | Matched response definition: INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | { INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | "status" : 200, INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | "body" : "{\"tariffSpecId\":\"Tservserv\",\"hasSplitBill\":\"true\",\"services\":[{\"serviceSpecId\":\"Tservadd\"},{\"serviceSpecId\":\"SERVICE_ROAMING\"},{\"serviceSpecId\":\"SERVICE_ROAMING_BUSINESS\"}]}", INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | "headers" : { INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | "Content-Type" : "application/json", INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | "Connection" : "close" INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | } INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | }
But as you see, I have another messages on each line (log level, module, timestamp). Could you suggest me any approach about how can I do it? I think that:
I must remove any entries of INFO | jvm 1 | main | 2017/06/11 10:29:22.699 | and attach only messages through multiline filter-plugin. BUT! How can I choose these specific messages, without breaking of whole log with other records.
Can I multiline message between two patterns? I mean between (\s|\t)+{$ and (\s|\t)+}$?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.