How to parse the log using grok to get the key value pairs from the log, and have the key as a new field

Elastic Stack Logstash
1

{"apiResponse":"{"errors":[{"code":"APP-1007","message":"Session has Expired.","fields":null}],"warnings":null}","requestUrl":"http://localhost:8082/checkSessionValidity"}

This is how the message looks like, I want to know how do i parse apiResponse and requestUrl and create the new fields and have their corresponding values

"_apiResponse": "{"errors":[{"code":"APP-1007","message":"Session has Expired.","fields":null}],"warnings":null}"

"_requestUrl": "http://localhost:8082/checkSessionValidity"

I am new to grok filter, sorry if this is a basic question

2

This looks like a JSON string, so try using the json filter instead of grok.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.