Grok pattern for datadog to get everything between two curly braces {}

Elastic Stack Logstash
1

Hi All,

Can anyone help to get GROK pattern of logs everthing between two curly braces

logsample: {
CONNECTION: keep-alive
X-ORIGINAL-URL: /Data/RetailItem.js?Log=1&Sync=0
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-FORWARDED-FOR: 192.25.54.77
X-APPGW-TRACE-ID: jksafjkcajfcnaslknd
HOST: ajsdhsakd
X-ORIGINAL-HOST: abcdnackls
CONTENT-LENGTH: 1234
AUTHORIZATION: Bearer gkjdahfjkdahfjkahfhjkdafcdajacnvjancj,asncasncasnclnascnas,nc,asncjasncasncasncjasncjanscjnasjcnasjcnasjncjasncjasncjasncjksancas
}

2

Hello,

Is your message one line or multiple lines? How the field logsample is being created?

Please share a sample of the document in the way it appears, use the preformatted text option, the </> button.

3

its showing multiple in lines, I need full one log in one line

image
image1453×595 94.6 KB

4

image
image1609×339 38 KB

5

Where are those screenshots from? They do not look like anything from Elastic stack.

You didn't provide what was asked, you need to share sample of your original document as a plain text.

Also, share your Logstash configuration as well.

6

This is the screenshot of my datadog logs.
I dnt understand from where we get those logs which you required

7

How are you logs getting into Logstash? Logstash has configuration pipelines with inputs, filters and outputs.

It is not clear what is your issue now since you mentioned Datadog. Are you really using Logstash?

8

Thats exactly I want to create a configuration pipeline of Grok pattern rule which simplify my logs (can be seen in screenshot that its showing multiple lines of single log), I want Grok parser pattern rule which can simplify my log in one line.

Supoose for example : {
CONNECTION: keep-alive
X-ORIGINAL-URL: /Data/RetailItem.js?Log=1&Sync=0
X-FORWARDED-PROTO: https
X-FORWARDED-PORT: 443
X-FORWARDED-FOR: 192.25.54.77
X-APPGW-TRACE-ID: jksafjkcajfcnaslknd
HOST: ajsdhsakd
X-ORIGINAL-HOST: abcdnackls
CONTENT-LENGTH: 1234
AUTHORIZATION: Bearer}

This is my single logsample under curly braces, This log is showing in dashboard in multiple lines. I want it in a single line with Grok parser.

9

You may be able to do that using a multiline codec on your input.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.