My line from filebeat looks like this:
2020-01-09T15: 19: 09.939859Z message = \"Some 'message' here \", ourProductID = 'AS6167527'
.
What should the regular expression look like to get the message field? I currently have the following code:
% {TIMESTAMP_ISO8601} message = \\"<There are need regex> \\", ourProductID = '% {WORD: ourProductID}'
You could use a custom pattern:
(?<msg>[^"]+)
If your message can contain escaped double quotes you would need to add a negative lookahead to that.
Thank you. I resolved this problem %{GREEDYDATA:message}
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.