Grok Debugger - hard to find identification string for my difficult example

{Result=[{Index=1, PropertyName=, ResourceA1=here, ResourceA2=heretoo, ResourceA3=hereagain, ResourceA4=herewego, ResourceKey=transactions.ui.rfc.messages.label.defaultMessage, ServiceKey='6457A5674GF01ED98EAC1Z9934909736', ServiceName=transactions_Simulations, Text=alliswellstructured-:o), Type=2},

Hi @ all,
i struggle with above mentioned unstructured pattern and would like to extract parts into
5 new fields while indexing using logstash grok :

Due to its specific start and length
I'm unable to solve the right pattern.
Hope you can help.

Thanks in advance

You can use KV filter, as your log is already in Key Value format.

		source => "message" 

Edit : You can use mutate filter to remove the fields that you don't want to index, because kv filter will add all the keys present in the log as fields.

I would suggest

mutate { gsub => [ "message", "^{Result=\[{", "" ] }
kv { field_split => "," value_split => "=" trim_key => " " }
1 Like

wow if I'd known how easy that is...
Thanks for reply

thanks too for reply but I'm unsure where to close the missing braces in right way?
Thats like try and error

Hi all,

I found a way to handle this case as good as possible @ my personal experience level but for my knowledge I have one more question:

{Result=[{ bla=2, bla=4, bla6 ,Type=2}]}

The First Entry removed by:

mutate {
gsub => [ "getMessage", "^{Result=\[", "" ]}


Now Id like to remove the last entry with like a similar gsub:

mutate {
gsub => [ "getMessage", "^,Type=2\}\]\}", "" ]}

But it wont work!

Please let me know how I can remove it!


] has a special meaning in a regexp (it closes a character group) so it needs to be escaped using \. That is not the case for }, which does not need to be escaped.

Oh man then I were right but tought I were wrong because the Closed Square Bracket behind Type2 associated to the opening and the obvious to close were not obvious though...


Thanks, you saved my day :wink:

me again, its not working
still part of the pattern
What I Did to solve:

First remove all Brackets then the field itself:

mutate {
gsub => [ "getMessage", "\\[|\\]", "" ]}
mutate {
gsub => [ "getMessage", "\{\}", "" ]}

mutate {
gsub => [ "getMessage", "Type=2", "" ]}
mutate { gsub => [ "message", ",Type=2}\]}$", "" ]}

should work. You were anchoring the pattern to ^.

no sadly no :slight_smile: ,Type=2}]} still there
and thats the reason why I have headaches of thus hmm... :triumph: logstash filter...
Many ways to Rom but none arrives...

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.