Grok and curly brackets

[vaclav1]

Dear team,

I have a grok filter which needs to parse following part of line from the Haproxy logs:

{*/*||en-US|10.12.132.200:30012||||1997-04-09-17.02.03.246664|pclient_us}

Now how do I remove the brackets from beginning and end?

grok {
         match => {
            "requestResponseBegin" => [
               "\{%{DATA:[http][requestHeaders]}\}"
            ]
         }
}

I tried to escape it but pipeline is not compiled.

[Cad]

Hi,

You dont have to escape the brackets in a grok pattern.
Your current grok pattern work and remove the brackets because there not concern by the regex DATA.

If you want to just remove the brackets, you can use the gsub option of the mutate filter.

Cad.