Logstash parse strings before a valid json

Elastic Stack Logstash
1

Hello, i have the following log : Received stock info for v2, payload: {'id': '1234dads', 'sku': '1QA0QWQ-1JFQQQ'} and i would like to add a new field with phase before json ,i tried the following config but is now working .

if "Received" in [information] and [kubernetes][namespace] == "namespace" {
grok {
match => [ "information", "(?[^{]*)"]
}
mutate { add_field => { "payload_msg" => "%{payload}"}}
json {
source => "information"
}

Can you please let me know what is wrong ?

paylod = Received stock info for v2, payload: and after parse the information field using json

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.