With the Grok Debugger I managed to create the right Grok pattern for the message I would like to parse. When trying to add the following Grok pattern in the Processor for the Ingest Node Pipeline, I get an error message "Invalid JSON"
For the following message I use the following Grok pattern, which is just fine:
[2021-03-14T15:59:16,860][INFO ][o.e.x.i.IndexLifecycleTransition] [LAPTOP-V6JS] moving index [filebeat-7.11.2-2021.03.14-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [filebeat]
\[%{TIMESTAMP_ISO8601:log_timestamp}]\[%{WORD:log_level} ]\[%{NOTSPACE:log_action}] \[%{NOTSPACE:node_name}]%{GREEDYDATA:log_details}
Here is the screenshot of the message.
Do I have to reformat the Grok pattern to be able to create the pipeline. In a previous version (7.11) this worked just fine with exactly the same Grok pattern.