I have a log that I am parsing using grok and kv: filter { grok { match => {"message" => "msg=%{WORD:action} %{GREEDYDATA:kvpairs}" } } kv { source => "kvpairs" remove_field => ["kvpairs"] } } One of the values in my kvpairs is structured JSON data that I want to interpret as a…

Kvpairs where one of the values is a JSON structure

robynkoz August 25, 2015, 3:15am 7

I'm looking at the log entry in Kibana and I see a

tags: _jsonparsefailure

entry in the log

And I can see that the jsonpairs string is truncated (as is jsondata). I can see the full json string in the message value.

Topic		Replies	Views
Parsing mixing of json and kv filter in logstash Logstash	6	2628	October 1, 2018
Parsing a mix of String and JSON fields with the kv() filter Logstash	3	4242	August 8, 2017
Parse mix of String, JSON and KeyValue Logstash	3	1277	March 4, 2019
KV filter on ugly json log Logstash	5	452	October 17, 2022
Using KV and Grok to parse complex data Logstash	2	570	June 30, 2021