Grok pattern for capturing string with CR in the middle

Hi All
new here and in general to Logs in general
i have encountered problem to generate a Grok (for an extractor) pattern so it will capture string cut in the middle (sometimes) by a CR and continues, i want to capture it all to one variable (not containing the CR and spaces if exists)
the string is
2019-04-14 15:15:26 0x2b92f0e00700[A
WS_OSCAR_INFO]:Taking preemptive lock on ''.bla bla bla'
i want to capture the AWS_OSCAR_INFO as a parameter loglevel
searched a lot , and tried myself but couldnot solve it
the max is that i got parameter containg A WS_OSCAR_INFO , but i want it without the space
thanks for the helpers...

Try

    grok { match => { "message" => "\[%{DATA:foo}\]" } }
    mutate { gsub => [ "foo", "\s*", "" ] }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.