Grok result can not find my data field

Elastic Stack Logstash
1

I try to use Grok to match some log like below:
[2016-09-07 00:00:02] online.INFO: GenerateLogData: {"userType":"MERCHANT","targetPlatformUserNo":"5mwe"}
with pattern :
\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: %{DATA:basetype}:%{DATA:json}

but the result is something unexpected

{
    "@timestamp" => "2016-09-14T06:28:00.505Z",
       "message" => "[2016-09-07 00:00:02] online.INFO: GenerateLogData:{\"userType\":\"MERCHANT\",\"targetPlatformUserNo\":\"5mwe\"}  ",
      "@version" => "1",
          "host" => "0fbd5f9e910a",
     "timestamp" => "2016-09-07 00:00:02",
           "env" => "online",
      "severity" => "INFO",
      "basetype" => "GenerateLogData"
}

where is my json field?

2

DATA is non-greedy, i.e. it's perfectly happy with matching nothing. If you change the grok expression to either

...%{DATA:json}$

or

...%{GREEDYDATA:json}

it'll work. You should also be careful with multiple DATA patterns in the same expression (especially if combined with GREEDYDATA). Depending on the expression and the input you can easily get unexpected matches.

3

thanks!
you are my savior