Please help with logstash Filter

Hi, i am sending some json message using axios.get() . in Logstash i am receiving GET /?{%22level%22:%22INFO%20From%20Web%20Client%22,%22time%22:%22Wed%20Jul%2017%2018:26:43%202019%22,%22kbID%22:%220%22,%22info%22:%22Current%20Memory%20Footprint%22} HTTP/1.1\r\nHost: 10.12058.5540\r\nConnection: keep-alive\r\nAccept: application/json, text/plain, /\r\nOrigin: http://localhost:3000\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36\r\nReferer: http://localhost:3000/calendar\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: en-US,en;q=0.9,ar;q=0.8,fr;q=0.7,el;q=0.6,hi;q=0.5,it;q=0.4,ja;q=0.3,ko;q=0.2,la;q=0.1,ml;q=0.1,mr;q=0.1,pl;q=0.1,fa;q=0.1,ps;q=0.1,vi;q=0.1,th;q=0.1,es;q=0.1\r\n\r\n

but want my real data is {%22level%22:%22INFO%20From%20Web%20Client%22,%22time%22:%22Wed%20Jul%2017%2018:26:43%202019%22,%22kbID%22:%220%22,%22info%22:%22Current%20Memory%20Footprint%22

that to in elastic want in this format, please advice how to filter it or some other way i need to decode my data

"message": {

  "level": "INFO From Qt Client.",

  "info": "LV3 socket error occured.",     

},
    grok { match => { "message" => "/\?%{DATA:[@metadata][json]} HTTP" } }
    urldecode { field => "[@metadata][json]" }
    json { source => "[@metadata][json]" }

will get you

     "kbID" => "0",
    "level" => "INFO From Web Client",
     "time" => "Wed Jul 17 18:26:43 2019",
     "info" => "Current Memory Footprint"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.