title: grok regex in logstash to parse and extract field
body: <p>I am trying to extract certain fields from a single message field. I am trying to achieve this by grok regex on the logstash so that i could view them in kibana.</p>
  <p>My log events is as below:
  <code>[2021-01-06 12:10:40] ApiLogger.INFO: API log data:  {&quot;endpoint&quot;:&quot;/rest/thre_en/V1/temp-carts/13cEIQqUb6cUfxB/tryer-inform&quot;,&quot;http_method&quot;:&quot;GET&quot;,&quot;payload&quot;:[],&quot;user_id&quot;:0,&quot;user_type&quot;:4,&quot;http_response_code&quot;:200,&quot;response&quot;:&quot;{\&quot;pay_methods\&quot;:[{\&quot;code\&quot;:\&quot;frane\&quot;,\&quot;title\&quot;:\&quot;R2 Partial redeem\&quot;}],\&quot;totals\&quot;:{\&quot;grand_total\&quot;:0,\&quot;base_grand_total\&quot;:0}}</code></p>
  <p>The entire log has more information into different key value store-
  Basically, I needed these information -</p>
  <ol>
  <li>time stamp (i am able to get this)</li>
  <li>log level (I am able to get this) =&gt; on loglevel, i just want the info not the entire Api.INFO</li>
  <li>endpoint</li>
  <li>http-method</li>
  <li>user_id</li>
  <li>user_type</li>
  <li>http_response_code</li>
  <li>response</li>
  </ol>
  <p>I am not able to get the information from 3-8 ... i tested it. it is due to the semi colon(:)
  this is what i tried through grok debugger
  <code>%{SYSLOG5424SD:logtime} %{JAVACLASS:loglevel}: (?&lt;API&gt;\w+ \w+ \w+):</code></p>
  <p>i tried uri and other but it did not work, may be due to the colon.</p>