Search code examples
regexkibana

Regex to Trim a String inside JSON

I have the following log message inside LogZ and I'd like to trim it before forwarding it as an alarm:

[ {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:08Z\"}\n"
}, {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:06Z\"}\n"
}, {
 "message" : "{\"level\":\"error\",\"msg\":\"Unexpected error! Contact the administrator!\",\"reason\":\"Error while unmarshalling the incoming data. Likely due to formats mismatch\",\"status\":\"500\",\"success\":false,\"time\":\"2022-02-15T18:47:05Z\"}\n"
} ]

Since LogZ (Kibana) supports Regex, the main idea was to remove everything besides the reason field with the message it carries. So is there anyway I can use regex to end with the following message?:

reason: Error while unmarshalling the incoming data. Likely due to formats mismatch

Solution

  • Sure you can do it using positive look behind from string reason\":\" and extract all character behind it until \.

    Here the example : https://regex101.com/r/14otax/1

    (?<=reason\\":\\")[^\\]+

    example regex