I am facing a weird issue in Datadog logs whereby if a log string contains JSON bracers, ie. {}, the log will somehow not appear in Datadog, otherwise it will appear just fine.

Example:
Supposed there are 2 log messages

• [SRE-TEST] First message
• [SRE-TEST] Second message

These messages will be displayed just fine, as shown below (2 lines).

Now if I change one of the log, eg. [SRE-TEST] First message to [SRE-TEST] {"some":"json"} or even just {}, only [SRE-TEST] Second message will be shown.

These is the Grok parsing rule in my Datadog pipeline processor

Parsing rule:

Rule4 Apps%{integer:thread_id}soutput:s[A-Z],s[%{date("yyyy-MM-dd'T'HH:mm:ss.SSSSSS"):date}s#[0-9]+]s+%{word:level}s--s%{data:transaction}:s[%{uuid:uuid}]s[%{data::keyvalue}]s%{data:message}

Sample log:

App 266 output: I, [2024-07-25T16:40:28.768602 #266]  INFO -- transaction: [0cdaa6f9-a72b-9b99-afe7-25f0cb69415c] [dd.env=staging dd.service=my_app dd.trace_id=4943834306632983193 dd.span_id=3095791507286419633 ddsource=ruby] [SRE-TEST] {"some":"json"}

The parsing rule matches the log actually.

Any idea which part could be the root cause?