Hi @79g unfortunately i have not used kibana dev tool i test this on online grok parsing tool. I want only expected output just want 2 field response_code and message field after 400 value but i am getting | in front of the message field value
Happy to help Just mark my reply as solution for making easier for others to find.
You can not put the character | inside JSON without escaping. Some special characters could be interpreted and cause failures. To avoid this is necessary to add a \ before. You can search about json escaping
By default, | is used for alternation, so that you might match either AM or PM in a timestamp using (AM|PM). If you have a literal | in the message then you need to escape it with a backslash for the regexp to match it.