Yes because the only line who contrains a UUID is thefingerprint one.
I did a mistake for the version QUOTEDSTRING in the debugger.
The code i write :
In the grok debugger : %{QUOTEDSTRING:key}":%{SPACE}%{QUOTEDSTRING:value}
Must be :
In the grok debugger : %{QUOTEDSTRING:key}:%{SPACE}%{QUOTEDSTRING:value}
# I remove the ' " ' after the first QUOTEDSTRING.
The QUOTEDSTRING pattern altready do that job (in the logstash file, the debugger return only the first match). In the logstash file, he read the logstash input Line by Line, put the first value in quote in the field key and the second one in the field value
You can do that with a condition before the grok filter or a condition into the output part of the logstash file.
Cad.