Grok pattern

[Divya_Bansal]

I have to parse this log-
05-10-21T13:17:20.457741775|lapideployment-547944bff7-4f2qr|1|iuser|20|0|25.090g|1.378g|68160|S|0.0|1.1|116:20.87|java|265

I am using pattern-%{TIMESTAMP_ISO8601:timestamp}|%{DATA:pod}|

It is returning result as-
{
"timestamp": [
[
"05-10-21T13:17:20.457741775"
]
],
"pod": [
[
null
]
]
}

Can anyone help me with parsing this log?

[Mustafa_NAJIB (Mustafa)]

Hello,
i think that you have to add \ before the "|"
this is your input data :
05-10-21T13:17:20.457741775|lapideployment-547944bff7-4f2qr|1|iuser|20|0|25.090g|1.378g|68160|S|0.0|1.1|116:20.87|java|265

this is the new filter / pattern :

 grok {
      match          => {
        "message"    => [
          "^%{TIMESTAMP_ISO8601:logdate}\|%{GREEDYDATA:pod}",
          "%{GREEDYDATA:FAILPARSE}"
        ]
      }
    }

Output :
"logdate": "05-10-21T13:17:20.457741775",
"message": "05-10-21T13:17:20.457741775|lapideployment-547944bff7-4f2qr|1|iuser|20|0|25.090g|1.378g|68160|S|0.0|1.1|116:20.87|java|265",
"pod": "lapideployment-547944bff7-4f2qr|1|iuser|20|0|25.090g|1.378g|68160|S|0.0|1.1|116:20.87|java|265"

[Divya_Bansal]

thank you so much, it worked