Here's my log data
INFO 2024-02-06 13:21:28,266 495bf10d1bce434b8713682b5a2a896a logger 14 140316994739016 {"ip": "42.108.76.251", "user": "AnonymousUser", "method": "GET", "path": "/api/v1/station-mapping/", "status": 200, "request": {}, "response": "({\"station_map\": []})", "request_headers": {"HTTP_HOST": "fleet.vogorental.com", "HTTP_X_FORWARDED_HOST": "fleet.com", "HTTP_X_FORWARDED_SERVER": "fleet.com", "HTTP_X_FORWARDED_FOR": "42.108.76.251, 172.31.152.72", "HTTP_CONNECTION": "keep-alive", "HTTP_X_FORWARDED_PROTO": "https", "HTTP_X_FORWARDED_PORT": "443", "HTTP_X_AMZN_TRACE_ID": "Root=1-65c1e500-30956e3c2764aaa02e4a3h98e", "HTTP_ACCEPT_ENCODING": "gzip", "HTTP_USER_AGENT": "okhttp/4.10.0", "HTTP_IF_MODIFIED_SINCE": "Tue, 06 Feb 2024 07:47:37 GMT", "HTTP_REQUEST_UUID": "ffc43eh14-dafc-4380-b38e-a51b385c2114"}, "http_request_uuid": "ffc43e14-dafc-4380-b38e-a51jb385c2114", "jaeger_trace_id": null, "query_params": {"stop_ids": "lFwsljvX, ggPddWUh, adOlCUwN, STrovoZV, CYaCUDHY, eMiVDgkb, azYjNFSN, wpBacjyO, txXNCMWV, kjIDUJII, gZVvLCWu, EaZdTYAL, XJjwbLfy, McEyfdTX, jWFADYBF, AvfcbXij, jTNZKRyL, tTgkjSdt, hkEJDoLW, ofhOrnye, xuioTDcf, TFMDJzFG, QPHPyXJO, cYzqOZdd, kZPicVSg, hIABsYSL, sGioOeHk, TBoESADR, bvZgRcfT, eyrlamQe, lbAEtdkn, jhskDhQU, eUmzTrEF, mTVCzHtt, WfsUFiQl, KssOjfQh, KSUnFHKS, mcoVhWhz, gFgMfGwp, LRzsmeLM, fROMTWyB, PuOVcuMS, pevyZnrx, lHkJzPUh, MyzOZElG, hnkZoAwl, iIOkzOZc, pvCEzoOM, gOAdTOkZ, ASjLmkqh, BgBMUGnm, FmHcIFtj, gsZKeMsn, oBnCJbtv, ySIJjuzg"}}
and my grok pattern is -
%{LOGLEVEL:loglevel} %{TIMESTAMP_ISO8601:ts} %{DATA:request_id} %{WORD:module} %{NUMBER:pid} %{NUMBER:thread} %{GREEDYDATA:data} "path": "(?<path>[^"]+)"
but this outputs
[
{
"loglevel": "INFO",
"ts": "2024-02-06 13:21:28,266",
"request_id": "495bf10d1bce434b8713682b5a2a896a",
"module": "logger",
"pid": 14,
"thread": 140316994739016,
"data": "{\"ip\": \"42.108.76.251\", \"user\": \"AnonymousUser\", \"method\": \"GET\",",
"path": "/api/v1/station-mapping/"
},
null
]
The above grok pattern does not have the whole value and only have the content before the word "path". I wanted to have the whole data content as well as the path values.