I have the following log snippet with a JSON payload that includes a newline. How do I extract the entire JSON payload?
ID: 123
Payload: {
"info":{
"name":"bob",
"age":"35"
}
}
Expected field should contain:
{
"info":{
"name":"bob",
"age":"35"
}
}
This should do the trick for you:
Payload: (?P<YourField>[^\}]+\}){2}
Assuming that all your payloads only have 2 close curly brackets '}'
Use the "interactive field extractor" view to test the regex before applying it (run your search > click the blue box next to one of the events > select "Extract Fields")
EDIT:
Change the value {2} from my above code to match the number of "closing curly brackets" '}' in your payload to have the regex work.
This should do the trick for you:
Payload: (?P<YourField>[^\}]+\}){2}
Assuming that all your payloads only have 2 close curly brackets '}'
Use the "interactive field extractor" view to test the regex before applying it (run your search > click the blue box next to one of the events > select "Extract Fields")
EDIT:
Change the value {2} from my above code to match the number of "closing curly brackets" '}' in your payload to have the regex work.
As long as the number of "closing curly brackets" '}' is consistent across all your payloads, just count them and then change the {2} from my original post to the new number.
So in your latest example the {2} should be changed to a {4}.
That's actually not the case. I have something like:
{
"test":{
"a":"b"
"c":{
"d":"e"
}
}
"e":{
"f":"g"
}
}