Grok filter inquiry

Hello, how to extract a specific word out of a string without spaces, for example:
'stock_status': 'IN_STOCK','title_ar': u'Happy Wedding Card'

I want to extract the (IN_STOCK), I tried:

match => [ "message", "'stock_status': '%{GREEDYDATA:stock_value}'," ]

But the output is:
"IN_STOCK','title_ar': u'Happy Wedding Card"

How can I add something like a termination character (e.g: comma).

You could try this pattern in your Grok:

    match => [ "message", "'stock_status': '.*status\'\:\s\'(?<stock_status>\w*)" ]
1 Like

@Kryten I tried it, but it doesn't match :frowning:

Hmm... It should:

Is the example line you supplied accurate?

1 Like

But shouldn't I try the whole pattern instead?

Do me a favour.. paste the pattern you are trying to use into the message so I can use it too to see what you see..
Why do you want more in the pattern than you need?

Issue fixed, this one is working now

    match => [ "message", ".*status\'\:\s\'(?<stock_status>\w*)" ]

Thank you @Kryten!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.