Adding a new field from multiple fields and including a newline

[elvarb (Elvar)]

I have an event with multiple fields and I want to create a new summary field with specific details but also want to add the newline character in that field. No matter what I try the add_field option in mutate does not want to convert \n to a newline. Is there some way to do this?

For example

	mutate {
		add_field => { 
			"email" => "%{mailbox} \n %{date}"
		}
	}

[magnusbaeck (Magnus Bäck)]

Strings in the Logstash configuration have no generic support for escape sequences. I suspect you'll have to use a ruby filter to generate the string instead, perhaps something like this (assuming Logstash 2.4 or later):

ruby {
  code => "event.set('email', event.get('mailbox') + ' ' + 10.chr + ' ' + event.get('date'))"
}

[elvarb (Elvar)]

Thanks, that worked!

I have had to use Ruby so much lately that it's crazy. Logstash 5+ seems to be having huge issues with character encoding, going to gather my notes and create a ticket tomorrow.