Hello, I've a sample line 'stock_status': 'IN_STOCK', 'title_ar': u"World's Greatest Mum Card"
I want to parse the stock_status value, so I created this grok filter
grok{
match => [ "message", "'stock_status': '%{GREEDYDATA:stock_value}'" ]
}
but the output is:
"stock_value": [
[
"IN_STOCK', 'title_ar': u"World"
]
]
I want it to be:
"stock_value": [
[
"IN_STOCK"
]
]
Can you help?