# Escaping return carriage in json message body

**URL:** <https://discuss.elastic.co/t/escaping-return-carriage-in-json-message-body/58717>\
**Category:** Logstash\
**Created:** [August 23, 2016, 4:53pm UTC](https://discuss.elastic.co/t/escaping-return-carriage-in-json-message-body/58717 "2016-08-23T16:53:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kalim](https://avatars.discourse-cdn.com/v4/letter/k/c6cbf5/32.png) [@kalim](https://discuss.elastic.co/u/kalim)\
**Post date:** [August 23, 2016, 4:53pm UTC](https://discuss.elastic.co/t/escaping-return-carriage-in-json-message-body/58717/1 "2016-08-23T16:53:37Z")

</div>

Hi,

Am using logstash-input-azureeventhub plugin to get data from Azure event hub. Am getting json parse error on return carriages when trying to import data. Please see below:

Message:  
{"app\_Name":"KalimTest","Value":"hello \n world"}

Logstash Config:  
azureeventhub {  
key =\> "myKey"  
username =\> "usename  
namespace =\> "myNamespace"  
eventhub =\> "my evenhubname"  
partitions =\> 4  
thread\_wait\_sec =\> 10  
}

Error in logstash:

{:timestamp=\>"2016-08-23T16:34:11.981000+0000", :message=\>"JSON parse failure. Falling back to plain-text", :error=\>#\<LogStash::Json::ParserError: Unrecognized character escape 'x' (code 120)  
at [Source: [B@7b51d3a1; line: 1, column: 42]\>, :data=\>"{"app\_Name":"KalimTest","Value":"hello \x5c\x5cn world"}", :level=\>:info, :file=\>"/logstash/logstash-2.3.3/vendor/bundle/jruby/1.9/gems/logstash-codec-json-2.1.4/lib/logstash/codecs/json.rb", :line=\>"67", :method=\>"legacy\_parse"}

How can I escape certain characters in json? Perhaps via a filter? I've tried gsub but of course it won't parse JSON. I'v tried double slash (\n) in original message but to no avail

Please advise.

Cheers,

Kalim

---

<div class="post-metadata">

**Author:** ![kalim](https://avatars.discourse-cdn.com/v4/letter/k/c6cbf5/32.png) [@kalim](https://discuss.elastic.co/u/kalim)\
**Post date:** [August 25, 2016, 8:17am UTC](https://discuss.elastic.co/t/escaping-return-carriage-in-json-message-body/58717/2 "2016-08-25T08:17:53Z")

</div>

So I got around the problem by adding the following filter. Issue with plugin obviously still exists. I believe this to be an issue with the json codec provided by Logstash which the plugin is using.  
`mutate { replace => ["message", "%{message}"] gsub => ['message','\\x5cr','', 'message','\\x5cn',''] } if [message] =~ /^{.*}$/ { json { source => message } }`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/escaping-return-carriage-in-json-message-body/58717/3 "2017-07-06T04:41:39Z")

</div>