Parse substring in a line in grok

[ibrahimsharaf (Ibrahim Sharaf El Den)]

Hello, I've a sample line 'stock_status': 'IN_STOCK', 'title_ar': u"World's Greatest Mum Card"
I want to parse the stock_status value, so I created this grok filter

grok{
match => [ "message", "'stock_status': '%{GREEDYDATA:stock_value}'" ]
}

but the output is:

"stock_value": [
[
"IN_STOCK', 'title_ar': u"World"
]
]

I want it to be:

"stock_value": [
[
"IN_STOCK"
]
]

Can you help?

[paz]

Are those the complete samples of logs and grok pattern? If not, it would help pasting those instead.

Anyhow, you can try this (based on the above info)

grok{
    match => [ "message", "'stock_status': '%{NOTSPACE:stock_value}'," ]
}

[ibrahimsharaf (Ibrahim Sharaf El Den)]

This comma at the end solved the problem, thanks @paz