GrokPraseFailure - JSON log - Success on Grokdebugger

Elastic Stack Logstash
1

I am facing issues while trying to parse this log. I have tried multiple options but nothing seems to work. No error message in the logs, except for this _grokprasefailure tag in the records. Can you please help with what I am missing here?
When I try it in GrokDebugger, it works all fine.

Any help is appreciated.

Auto route reason : {"opportunityId":"0042f00000Kttt","accountNumber":"999999999999999","agId":"0051H0001111IWYqTTT","division":"US","errorCode":"EC-109","errorName":"GetDetails Not Found","errorDescription":"SiteDetails Not Found"}


filter {
      
    json {
        source => message
        add_field => {
            "region" => "us-east-1"
        }
    }
	if [message] =~ /Auto route reason/ {
		grok {
			match => {"message" =>'%{CISCO_REASON} : {"opportunityId":"%{DATA:opportunityId}",%{GREEDYDATA:Greedymessage}}'}
        }
    }
}
2 
input { generator { count => 1 lines => [ 'Auto route reason : {"opportunityId":"0042f00000Kttt","accountNumber":"999999999999999","agId":"0051H0001111IWYqTTT","division":"US","errorCode":"EC-109","errorName":"GetDetails Not Found","errorDescription":"SiteDetails Not Found"}' ] } }
filter {
    if [message] =~ /Auto route reason/ {
        grok { match => {"message" =>'%{CISCO_REASON} : {"opportunityId":"%{DATA:opportunityId}",%{GREEDYDATA:Greedymessage}}'} }
    }
}

This works fine for me

"opportunityId" => "0042f00000Kttt",
"Greedymessage" => "\"accountNumber\":\"999999999999999\",\"agId\":\"0051H0001111IWYqTTT\",\"division\":\"US\",\"errorCode\":\"EC-109\",\"errorName\":\"GetDetails Not Found\",\"errorDescription\":\"SiteDetails Not Found\"",
3

Thanks for your response.

However, this one doesn't work for me. Any reason or anything I can do to fix this?

image

4

I am puzzled why you would not have a _jsonparsefailure tag on the event, since the [message] field is not valid JSON. I suspect you are not running the configuration that you think you are.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.