# Grok Data in curly braces

**URL:** <https://discuss.elastic.co/t/grok-data-in-curly-braces/237680>\
**Category:** Logstash\
**Created:** [June 18, 2020, 4:47pm UTC](https://discuss.elastic.co/t/grok-data-in-curly-braces/237680 "2020-06-18T16:47:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 4:47pm UTC](https://discuss.elastic.co/t/grok-data-in-curly-braces/237680/1 "2020-06-18T16:47:52Z")

</div>

I have section in the log in curly braces

`Thu Jun 18 08:01:42 CEST 2020|{"timestamp":1592460102635,"caller":"test.customer@customer1","action":"LOGIN","message":"ID000066 User [test.customer@customer1] logged in successfully."}`

I am trying to parse this using the below grok filter

`%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{WORD:TZ} %{YEAR}|\{%{GREEDYDATA:DATA}\}`

The DATA is not being parsed. Do I have to use a different approach ?

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [June 18, 2020, 4:52pm UTC](https://discuss.elastic.co/t/grok-data-in-curly-braces/237680/2 "2020-06-18T16:52:46Z")

</div>

I have to escape the | and it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2020, 4:52pm UTC](https://discuss.elastic.co/t/grok-data-in-curly-braces/237680/3 "2020-07-16T16:52:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.