Message "Invalid JSON" when inserting a Grok pattern in a Processor for an Ingest Node Pipeline

Elastic Stack Logstash
1

With the Grok Debugger I managed to create the right Grok pattern for the message I would like to parse. When trying to add the following Grok pattern in the Processor for the Ingest Node Pipeline, I get an error message "Invalid JSON"

For the following message I use the following Grok pattern, which is just fine:

[2021-03-14T15:59:16,860][INFO ][o.e.x.i.IndexLifecycleTransition] [LAPTOP-V6JS] moving index [filebeat-7.11.2-2021.03.14-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [filebeat]

\[%{TIMESTAMP_ISO8601:log_timestamp}]\[%{WORD:log_level} ]\[%{NOTSPACE:log_action}] \[%{NOTSPACE:node_name}]%{GREEDYDATA:log_details}

Here is the screenshot of the message.

Schermafbeelding 2021-10-05 om 08.12.51
Schermafbeelding 2021-10-05 om 08.12.511966×1460 314 KB

Do I have to reformat the Grok pattern to be able to create the pipeline. In a previous version (7.11) this worked just fine with exactly the same Grok pattern.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.