I'm parsing some log files with grok, but I have the following trace:
[es.org.some.Object[
attr1=53212
searchTags=[love, rock]
]]
[es.org.some.Object[
attr1=54612
searchTags=[love, peace, rock]
]]
I use the following expression for one:
%{DATA}\[%{JAVACLASS:Object}\[%{DATA}attr1=%{NUMBER:attr1}%{DATA}searchTags=%{DATA:searchTags}\]\]
but I have serverals... how can I parse this to have the next document:
Object1attr1: 53212
Object1searchTags: [love, rock]
Object2attr1: 54612
Object2searchTags: [love, peace, rock]
This is the best way to do this?
Thanks!! Regards.