Greedydata not working for part of the log record

Elastic Stack Logstash
1

I've a log record for which I've written the grok pattern (both pasted below),

120-155473611354900075^|^UPC^|^Optimus^|^N1VL-TA-NPI03.india.airtel.itm^|^2019-05-15 19:06:47.233356^|^9560041297^|^syniverse^|^Read^|^1.233063^|^1^|^"http://10.5.247.53:7001/v1/services/919560041297?lineOfBusiness=Mobility"^|^"{\"status_info\":{\"code\":\"200\",\"message\":\"Success\"},\"params\":{\"requestId\":\"6113784483100000433\",\"uri\":\"\\/v1\\/services\\/919560041297?lineOfBusiness=Mobility\"},\"services\":[{\"si\":\"919560041297\",\"rtn\":\"9928454369\",\"circle\":\"Delhi\",\"cust_cat\":\"Platinum\",\"cust_class\":\"Airtel Employee\",\"cust_type\":\"Consumer\",\"org_name\":\"Bharti Airtel Ltd\",\"act_date\":\"20160620130341\",\"vipflag\":\"Normal\",\"biz_unit\":\"Mobility\",\"value_type\":\"Platinum\",\"arpu\":\"42.5\",\"si_lob\":\"POSTPAID\",\"si_is_btfly\":\"1\",\"si_seg\":\"SILVER3\",\"devices\":{}}]}"

%{USER:Txn_id}\^\|\^%{WORD:App_Name}\^\|\^(?<Backend>(.|[a-zA-Z])*)\^\|\^%{NEWTIME:timestamp}\^\|\^%{INT:MSISDN}\^\|\^%{WORD:MCH}\^\|\^%{WORD:operation}\^\|\^%{BASE16FLOAT:val1}\^\|\^%{INT:val2}\^\|\^%{GREEDYDATA:data}

My issue is, the part of the record with "http....." till the end, I want to parse it as greedydata. But that just doesn't happen. Can anyone please help me out here.

2

Please edit your post, select the log message and grok pattern and click on </> in the toolbar above the edit pane. Then verify in the preview pane on the right that they actually look like your data and pattern. Thanks!

3

Hi,
I can see that I've already done what you have asked me to. I don't know why it isn't reflecting on your end.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.