# How to split json value in log file using grok/regular expression

**URL:** <https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901>\
**Category:** Logstash\
**Created:** [December 23, 2016, 10:23am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901 "2016-12-23T10:23:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [December 23, 2016, 10:23am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901/1 "2016-12-23T10:23:16Z")

</div>

I have one log file which I need to extract the json content from the file and I need to parse it using logstash json filter. I wrote one grok pattern but which it is not working properly. Below is my log file.

> 2016-12-18 12:13:52.313 -08:00 [Information] 636176600323139749 1b2c4c40-3da6-46ff-b93f-0eb07a57f2a3 18 - API: GET [AAA Sorry Page](https://aaa.com/o/v/S?$filter=uid) eq '9'&$expand=org($filter=org eq '0')  
> {  
> "Id": "1b",  
> "App": "D",  
> "User": "",  
> "Machine": "DC",  
> "RequestIpAddress": "xx.xxx.xxx",  
> "RequestHeaders": {  
> "Cache-Control": "no-transform",  
> "Connection": "close",  
> "Accept": "application/json"  
> },  
> "RequestTimestamp": "2016-12-18T12:13:52.2609587-08:00",  
> "ResponseContentType": "application/json",  
> "ResponseContentBody": {  
> "@od","value":[  
> {  
> "uid":"","sId":"10,org":[  
> {  
> "[startDate":"2015-02-27T08:00:00Z","Code":"0","emailId":"xx@gg.COM](mailto:startDate%22:%222015-02-27T08:00:00Z%22,%22Code%22:%220%22,%22emailId%22:%22xx@gg.COM)"  
> }  
> ]  
> }  
> ]  
> },  
> "ResponseStatusCode": 200,  
> "ResponseHeaders": {  
> "Content-Type": "application/json;"  
> },  
> "ResponseTimestamp": "2016-12-18T12:13:52.3119655-08:00"  
> }

**My Grok pattern**

> grok {  
> match =\> ["message","%{TIMESTAMP\_ISO8601:exclude}%{GREEDYDATA:exclude1}(?[\s])(?\<json\_value\>[\W\w]+)"]  
> }

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [December 23, 2016, 11:21am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901/2 "2016-12-23T11:21:26Z")

</div>

so your logfile contains 1 line of text and then a multiline json document ?  
If so you need to use the multiline codec in the file input to collapse all those lines into one first.

Also, if you control the application that is logging, I'd suggest encoding a better log line that has a clear separation between the header and the json, or even logging everything as a json document  
For example, putting:  
`2016-12-18 12:13:52.313 -08:00` into `timestamp` key  
`636176600323139749 1b2c4c40-3da6-46ff-b93f-0eb07a57f2a3 18 - API: GET https://aaa.com/o/v/S?$filter=uid eq '9'&$expand=org($filter=org eq '0')` as `log_header` key

---

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [December 23, 2016, 11:34am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901/3 "2016-12-23T11:34:24Z")

</div>

I used multiline codec and I am sending the full event as single message

---

<div class="post-metadata">

**Author:** ![rajkamalkool6](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Post date:** [December 23, 2016, 11:36am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901/4 "2016-12-23T11:36:57Z")

</div>

The grok pattern which I wrote is not separating the json content..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2017, 11:37am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901/5 "2017-01-20T11:37:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.