# Escape pipe \\ Vertical Operator (|) in Ingress Pipeline for grok processor

**URL:** https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358
**Category:** Elasticsearch
**Created:** [June 9, 2020, 2:12pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358 "2020-06-09T14:12:07Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)
#### Post date: [June 9, 2020, 2:12pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/1 "2020-06-09T14:12:08Z")

</div>

I want to process logs separated by pipe '|' operator in an ingress pipeline using grok. How can I ignore this character in the pattern?  
Log data:

```auto
PUT /combined/_doc/1?pipeline=pipeline_combined_logs
{
    "service": "ise7085|19524"
}

```

Pattern:

```auto
{
        "grok": {
          "field": "service",
          "patterns": "%{DATA:user}\|%{DATA:pid}"
        }
        }
      }

```

Above pattern throw error

```auto
"Unrecognized character escape '|' 

```

Thanks!!!

---

<div class="post-metadata">

### Author: ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)
#### Post date: [June 9, 2020, 2:21pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/2 "2020-06-09T14:21:51Z")

</div>

You need to use a double backslash

```
      "patterns": "%{DATA:user}\\|%{DATA:pid}"
```

---

<div class="post-metadata">

### Author: ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)
#### Post date: [June 9, 2020, 2:59pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/3 "2020-06-09T14:59:21Z")

</div>

@val I tried your suggestion but it parses only user and pid field has no value now.

---

<div class="post-metadata">

### Author: ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)
#### Post date: [June 9, 2020, 3:01pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/4 "2020-06-09T15:01:43Z")

</div>

Try `INT` instead of `DATA`

---

<div class="post-metadata">

### Author: ![Atul\_Gunjal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/atul_gunjal/32/57232_2.png) [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)
#### Post date: [June 9, 2020, 3:09pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/5 "2020-06-09T15:09:20Z")

</div>

Thanks @val .. it worked.

---

<div class="post-metadata">

### Author: ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)
#### Post date: [June 9, 2020, 3:20pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/6 "2020-06-09T15:20:01Z")

</div>

Cool, glad it helped!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2020, 3:20pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358/7 "2020-07-07T15:20:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
