hello,
i have in input json file like this
{
"_index": "null",
"_type": "logs",
"_id": "Wh7cLM6uT0mmSLnqOrWxQw",
"_score": null,
"_source": {
"host": "null",
"@timestamp": "2015-10-12T12:09:12.338Z",
"event": "2015-10-12 15:08:50,154",
"session_id": "null",
"module": "null",
"LEVEL": "INFO",
"DT": "20151012 15:08:49.727",
"TYPE": "INREQ",
"REF": "null",
"EXTATTR": {
"THD": "http-8082-31",
"MDL": "test",
"STATE": "OK",
"MTD": "doTest"
},
"DURATION": 419,
"REQUEST_URI": "/scheme/list",
"RESPONSE_CODE": "200",
"RESPONSE_BODY": "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?><c id="0000"/>",
"RESPONSE_HEADERS": {
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "POST, GET, OPTIONS, DELETE",
"Access-Control-Allow-Credentials": "true",
"Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept, sessionID",
"reqID": "null"
},
"REQUEST_HEADERS": {
"x-real-ip": "127.0.0.1",
"host": "localhost",
"connection": "close",
"content-type": "application/xml",
"x-forwarded-for": "127.0.0.1",
"sessionid": "6475ggfdtrhhjdiurt076jg9",
"ssl": "YES"
},
"REQUEST_TYPE": "GET"
},
}
in output i need to get something like this :
I have this line is formed by "message_format"
T0]|[null]|[/scheme/list]|[20151012 15:08:49.727]|[419]|[%{STATE}]|[200]|[%{MTD}]|[]|[]
|[]|[]|[%{x-real-ip}]|[null]|[]|[]|[]|[]|[]|[GET
with elements of the first level there is no problem, but when I try to substitute the embedded value ("EXTATTR": {"THD": "http-8082-31", "MDL": "test", "STATE": "OK", "MTD ":" doTest "}), AutoCorrect regular expression to the value occurs.
I have tried different ways to substitute the regular season, but nothing happens. Can someone tell me the solution?