1

I'm parsing some log files with grok, but I have the following trace:

[es.org.some.Object[
 attr1=53212
 searchTags=[love, rock]
 ]]
[es.org.some.Object[
 attr1=54612
 searchTags=[love, peace, rock]
 ]]

I use the following expression for one:

%{DATA}\[%{JAVACLASS:Object}\[%{DATA}attr1=%{NUMBER:attr1}%{DATA}searchTags=%{DATA:searchTags}\]\]

but I have serverals... how can I parse this to have the next document:

Object1attr1: 53212
Object1searchTags: [love, rock]
Object2attr1: 54612
Object2searchTags: [love, peace, rock]

This is the best way to do this?

Thanks!! Regards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.