Grok filter for any symbol include string break

Hello. I'm trying to parse event message to fields.
There is no problem with simple fields, but i'm unable to highlight biggest field that looks like this:

Details: {"Realm_Size":68,"Realm":"","action_Size":11,"action":"ACTION_NONE","TokenType_Size":59,"TokenType":"","IssuerUrl_Size":78,"IssuerUrl":"","CertificateSerialNumber_Size":32,"CertificateSerialNumber":"123456789ASDGFHGFJDHGIYU"}

NOTSPACE and GREEDYDATA are not fit, because (as i think) field contains string breaks and other interesting symbols.

Is there any pattern that can highlight this peace of message?

Greedydata is basically .* - which will match the above text. Have you tried it on grokdebug?

Yes, and it's not working.
As I understand dot means any symbol except string break.

What do you mean by not working exactly? Post your full config...

I find out that problem was in extra string breaks in input and output.

So there was no real issue.

This thread can be closed or deleted.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.