# How to grok a text containing json

**URL:** <https://discuss.elastic.co/t/how-to-grok-a-text-containing-json/94180>\
**Category:** Logstash\
**Created:** [July 22, 2017, 1:14am UTC](https://discuss.elastic.co/t/how-to-grok-a-text-containing-json/94180 "2017-07-22T01:14:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssasporta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ssasporta/32/13695_2.png) [@ssasporta](https://discuss.elastic.co/u/ssasporta)\
**Post date:** [July 22, 2017, 1:14am UTC](https://discuss.elastic.co/t/how-to-grok-a-text-containing-json/94180/1 "2017-07-22T01:14:34Z")

</div>

I don't really understand how to grok the below text ?  
The response itself also needs to be pars.  
At least I Need an example for it.

```
 Timestamp:2017-07-21 17:32:32.778
*********************************************************************************************************************************
{
  "timestamp" : 1500676355572,
  "severity" : "Error",
  "userAgent" : "Mozilla/5.0 (Linux; Android 5.1.1; KFGIWI Build/LVY48F) AppleWebKit/537.36 (KHTML, like Gecko) Silk/59.3.1 like Chrome/59.0.3071.117 Safari/537.36",
  "raw" : {
    "requestUrl" : "ecommerce/subscription-info",
    "response" : "{\"errorCode\":\"000101\",\"errorMessage\":\"An error occurred calling backend application\",\"transactionId\":\"6cc771ff-d266-4b2e-981b-c07959559166\"}"
  }

```

Thanks  
Sharon.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 25, 2017, 8:58pm UTC](https://discuss.elastic.co/t/how-to-grok-a-text-containing-json/94180/2 "2017-07-25T20:58:06Z")

</div>

- Use a multiline codec to join these lines into a single event.
- Use a grok filter to separate the initial "Timestamp" and "\*\*\*\*\*..." lines from the JSON string that follows.
- Use a json filter to parse the JSON string that the grok filter extracted into a field of its own.
- Use a second json filter to parse the JSON string in the `[raw][response]` field created by the first json filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2017, 8:58pm UTC](https://discuss.elastic.co/t/how-to-grok-a-text-containing-json/94180/3 "2017-08-22T20:58:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.