Grok regex for a few words

My line from filebeat looks like this:
2020-01-09T15: 19: 09.939859Z message = \"Some 'message' here \", ourProductID = 'AS6167527'.
What should the regular expression look like to get the message field? I currently have the following code:
% {TIMESTAMP_ISO8601} message = \\"<There are need regex> \\", ourProductID = '% {WORD: ourProductID}'

You could use a custom pattern:

(?<msg>[^"]+)

If your message can contain escaped double quotes you would need to add a negative lookahead to that.

Thank you. I resolved this problem %{GREEDYDATA:message}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.