I must be going mad today, i can't get this filter to work.
I extracted a single log line from an azure activity log, so i parse it through grok debugger both in kibana and herokuapp and i can't get it to work. so i split it out and chopped it down to try and isolate why its not working
'createdDateTime': '2019-12-11T09:06:47.5489252Z', 'userDisplayName': 'Some User, 'userPrincipalName': 'email@example.com
and the pattern
and in both debuggers, it doesn't return anything, yet the individual usages work....
i know its friday, and its been a long slog this week, but im not surely missing something so simple here am i ?