I have log entries in the following format:
2022-07-14T15:08:05.372Z ffcb7ee9-0e73-42d9-a236-d90fb1dfb131 ERROR {"level":"error","timestamp":"\"2022-07-14T15:08:05.372Z\"", ..., "log":"{\"message\":{\"statusCode\":400, ...}
So it is basically: [timestamp] [id] [messageType] [JSONobject].
I would like to extract the object part as an accessible object. I have looked in multiple questions suggesting how to do it, but nothing works for me.
I tried:
parse @message '* * ERROR {"*"}' as ts, id, dataObj // all declared fields show empty
parse @message '* * ERROR *' as ts, id, dataObj // all declared fields show empty
parse @message '* * * *' as ts, id, ty, dataObj // here in the first field appears string containing [timestamp] [id] [messageType] [aPartOfObject] and the following fields contain some other parts of the JSON.
parse @message 'ERROR *' as dataObj // dataObject field comes empty
parse @message '{"*"}' as dataObj // dataObject field contains 'faulty' JSON string starting with first property name without the opening quotation mark level:"...
parse @message '{*}' as dataObj // similar as above, but starting with quotation mark: "level:"...
Before the parsing line I include filter @message like 'ERROR' to ensure only these logs get parsed.
Why is it not working as expected? How can I make it work?