Grok for - [BT:CHROME, BV:55, BL:en, CC:CZ]

Elastic Stack Logstash
1

Hi , i am trying to capture the while block in the grok along with the square brackets [] . The grok filter field should be displaying the data with the pattern inside it . Can someone please advise what should be grok for this.

[BT:CHROME, BV:55, BL:en, CC:CZ]

2

It's very hard to understand what you're asking. You want to match a string like "[BT:CHROME, BV:55, BL:en, CC:CZ]" and include the square brackets in the resulting field?

3

Hi @magnusbaeck yes .. i want to match a string like "[BT:CHROME, BV:55, BL:en, CC:CZ]" and include the square brackets in resulting field.

4

Then perhaps (?<name-of-field>\[[^\]]*\]) would do. It should match a [ followed by zero or more characters of any kind except ], followed by ].

5

Awesome ..Thanks magnusbaeck. It works