GROK filter for specific keyword and values

[Akshara]

LOG MSG : "2020-05-13 09:30:15.405 [localhost] [Services] [Request Id : 06118032-ba2f-406e-b6b3-89f0511924ba] [User Id : HUNTER@UK.B-AND-Q.COM] INFO com.logging.aspect.AspectController:120 - [1242,124202,] Exit LookupLastTransaction: Output ["Transaction_id =RT1242124202130519002650 TransactionDateTime =com.store.DateTimeCommonData@5f4c1899 TotalQuantity =6 TenderTotal = GrandTotal = TotalAmount =�29.94 ReturnAmount =�0.00"] "

Above line is my log message.As I am new to GROK filter I am finding it very difficult to parse the Total Amount as separate filed and send that to kibana. Can some one pls help how to filter the value as separate filed?

[Jasonespo (JasonE)]

Hi Akshara - do you have your grok for the rest of the log message? Or do you only want to take the "TotalAmount" value out?

[Akshara]

Hi Jason

This is my GROK filter
%{GREEDYDATA}(?< TotalAmount >(?<= TotalAmount =�)[^&]+)(?< ReturnAmount >(?<= ReturnAmount =�)[^&])

When I use this the output is coming like this
{
"TotalSalesAmount": "29.94 TotalReturnAmount =�",
"TotalReturnAmount": "0"
}
All I want is some thing like this
{
"TotalSalesAmount": "29.94 ",
"TotalReturnAmount": "0.00"
}

[Jasonespo (JasonE)]

Try this (not using any regex patterns) so make sure it will work with all your possible options

%{GREEDYDATA}TotalAmount%{SPACE}=%{DATA}%{NUMBER:TotalSalesAmount}%{SPACE}ReturnAmount%{SPACE}=%{DATA}%{NUMBER:TotalReturnAmount}

[Akshara]

Hi Jason,
Thx for the response.But it is not working

[Jasonespo (JasonE)]

What's the error you get? See below screenshot:

[Akshara]

Hi Jason,Thankyou verymuch for helping me. It is working in grokdebug.BUt when I try this in Kibana debugger it is not working. I am not sure what is the issue

[Akshara]

[Akshara]

Thanks a Ton Jason.It worked. It was my my Bad I did a mistake in debugger.
You saved my life...

I have few questions
1.If I need to add one more filter like this means
%{GREEDYDATA}Cash tenderAmount%{SPACE}=%{DATA}%{NUMBER:CashTenderAmount}

for log which will be printed in another line means ,how can I add multiple GROK filters in logsatsh.conf file?

2.If my log file has several other information which is printed in different lines means ,then if I use this GROK filters will fail or what?

Thanks

[Jasonespo (JasonE)]

I think I understood. You have one logstash.conf file and you want 2 different grok patterns to match two different potential log messages? You'd use this:

grok {
match => [
  "message", "GROKPattern1",
  "message", "GROKPattern2"
 
        ]
}