# Grok pattern for datadog to get everything between two curly braces {} **URL:** \ **Category:** Logstash\ **Created:** [July 5, 2023, 11:43am UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665 "2023-07-05T11:43:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![shekhsadiq21](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shekhsadiq21](https://discuss.elastic.co/u/shekhsadiq21)\ **Post date:** [July 5, 2023, 11:43am UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/1 "2023-07-05T11:43:44Z")
Hi All, Can anyone help to get GROK pattern of logs everthing between two curly braces logsample: { CONNECTION: keep-alive X-ORIGINAL-URL: /Data/RetailItem.js?Log=1&Sync=0 X-FORWARDED-PROTO: https X-FORWARDED-PORT: 443 X-FORWARDED-FOR: 192.25.54.77 X-APPGW-TRACE-ID: jksafjkcajfcnaslknd HOST: ajsdhsakd X-ORIGINAL-HOST: abcdnackls CONTENT-LENGTH: 1234 AUTHORIZATION: Bearer gkjdahfjkdahfjkahfhjkdafcdajacnvjancj,asncasncasnclnascnas,nc,asncjasncasncasncjasncjanscjnasjcnasjcnasjncjasncjasncjasncjksancas } ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 5, 2023, 1:04pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/2 "2023-07-05T13:04:11Z")
Hello, Is your message one line or multiple lines? How the field `logsample` is being created? Please share a sample of the document in the way it appears, use the preformatted text option, the `` button. ---
**Author:** ![shekhsadiq21](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shekhsadiq21](https://discuss.elastic.co/u/shekhsadiq21)\ **Post date:** [July 6, 2023, 7:33am UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/3 "2023-07-06T07:33:27Z")
its showing multiple in lines, I need full one log in one line ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/0/70b32474de1e6501d79832c388b8e40fff45b1bb.png) ---
**Author:** ![shekhsadiq21](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shekhsadiq21](https://discuss.elastic.co/u/shekhsadiq21)\ **Post date:** [July 6, 2023, 7:54am UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/4 "2023-07-06T07:54:38Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/4/3/437c2a233676ebd943ef81f0f5f98bd76d8ffbd9.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 6, 2023, 12:10pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/5 "2023-07-06T12:10:44Z")
Where are those screenshots from? They do not look like anything from Elastic stack. You didn't provide what was asked, you need to share sample of your original document as a plain text. Also, share your Logstash configuration as well. ---
**Author:** ![shekhsadiq21](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shekhsadiq21](https://discuss.elastic.co/u/shekhsadiq21)\ **Post date:** [July 6, 2023, 12:13pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/6 "2023-07-06T12:13:06Z")
This is the screenshot of my datadog logs. I dnt understand from where we get those logs which you required ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 6, 2023, 12:15pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/7 "2023-07-06T12:15:50Z")
> [@shekhsadiq21](#): > > I dnt understand from where we get those logs which you required How are you logs getting into Logstash? Logstash has configuration pipelines with inputs, filters and outputs. It is not clear what is your issue now since you mentioned Datadog. Are you really using Logstash? ---
**Author:** ![shekhsadiq21](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shekhsadiq21](https://discuss.elastic.co/u/shekhsadiq21)\ **Post date:** [July 6, 2023, 12:28pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/8 "2023-07-06T12:28:42Z")
Thats exactly I want to create a configuration pipeline of Grok pattern rule which simplify my logs (can be seen in screenshot that its showing multiple lines of single log), I want Grok parser pattern rule which can simplify my log in one line. Supoose for example : { CONNECTION: keep-alive X-ORIGINAL-URL: /Data/RetailItem.js?Log=1&Sync=0 X-FORWARDED-PROTO: https X-FORWARDED-PORT: 443 X-FORWARDED-FOR: 192.25.54.77 X-APPGW-TRACE-ID: jksafjkcajfcnaslknd HOST: ajsdhsakd X-ORIGINAL-HOST: abcdnackls CONTENT-LENGTH: 1234 AUTHORIZATION: Bearer} This is my single logsample under curly braces, This log is showing in dashboard in multiple lines. I want it in a single line with Grok parser. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 6, 2023, 4:47pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/9 "2023-07-06T16:47:47Z")
You may be able to do that using a multiline codec on your input. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 3, 2023, 4:47pm UTC](https://discuss.elastic.co/t/grok-pattern-for-datadog-to-get-everything-between-two-curly-braces/337665/10 "2023-08-03T16:47:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.