How to split json value in log file using grok/regular expression

Question

I have one log file which I need to extract the json content from the file and I need to parse it using logstash json filter. I wrote one grok pattern but which it is not working properly. Below is my log file.

2016-12-18 12:13:52.313 -08:00 [Information] 636176600323139749 1b2c4c40-3da6-46ff-b93f-0eb07a57f2a3 18 - API: GET https://aaa.com/o/v/S?$filter=uid eq '9'&$expand=org($filter=org eq '0')
{
  "Id": "1b",
  "App": "D",
  "User": "",
  "Machine": "DC",
  "RequestIpAddress": "xx.xxx.xxx",
  "RequestHeaders": {
  "Cache-Control": "no-transform",
  "Connection": "close",
  "Accept": "application/json"
},
  "RequestTimestamp": "2016-12-18T12:13:52.2609587-08:00",
  "ResponseContentType": "application/json",
  "ResponseContentBody": {
  "@od","value":[
    {
      "uid":"","sId":"10,org":[
        {
          "startDate":"2015-02-27T08:00:00Z","Code":"0","emailId":"[email protected]"
        }
      ]
    }
  ]
},
  "ResponseStatusCode": 200,
  "ResponseHeaders": {
  "Content-Type": "application/json;"
},
  "ResponseTimestamp": "2016-12-18T12:13:52.3119655-08:00"
}

My Grok pattern

grok {              
         match => [ "message","%{TIMESTAMP_ISO8601:exclude}%{GREEDYDATA:exclude1}(?<exclude2>[\s])(?<json_value>[\W\w]+)"]                      
    }

Answer 1

Assuming this is all one message (it's not multiline, or has been combined before now) and there's a space between the URI and the json, this grok pattern should work:

%{TIMESTAMP_ISO8601} %{NOTSPACE:timezone} \[%{WORD:severity}] %{WORD:field1} %{UUID:field2} %{NUMBER:field3} - API: %{WORD:verb} (?<field4>[^\{]*) %{GREEDYDATA:json}

It would have been nice to use %{URI}, but the string you have is not a valid URI (it contains unescaped spaces).