Hi there!
I'd like to have already parsed field app_message additionally parsed with fields like language, companyEmail, country ,
Please suggest the proper way to do this.
<filter kubernetes.**>
#@id filter_parser
@type parser
key_name log
reserve_data true
reserve_time true
<parse>
@type grok
grok_failure_key grokfailure
<grok>
pattern %{TIMESTAMP_ISO8601:app_timestamp}" level\=%{DATA:app_log_level} msg\=%{GREEDYDATA: **app_message** }
</grok>
</parse>
</filter>
app_message content:
Create data draft in db: DatasetDraftVO(id=d57f73fc547f, datasetVO=null, entityId=legalEntityId, datasetVersion=1, data=VerifiableCredential(contexts=[https://www.w3.org/2018/credentials/v1, https://app.com/api/v1], id=le_cd_1, types=[VerifiableCredential,credentialSubject={"corporateData":{"bylaws":{"value":""}," **language** ":{"value":"English"}," **legalForm** ":{"value":"Private limited company"}," **legalName** ":{"value":"CompanyName1"}," **companyEmail** ":{"value":"[te...@mail.com](javascript:)"}," **companyWebsite** ":{"value":"MyProgram.fr"}," **country** ":{"value":"France"}," **mailbox** ":{"value":"444"}," **zipCode** ":{"value":"2000"}} proofs=null), **draftStatus** =DRAFT)