# Filebeat grok processor with pipe delimiter not working

**URL:** <https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 13, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913 "2018-07-13T09:24:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![blutswende](https://avatars.discourse-cdn.com/v4/letter/b/e99b99/32.png) [@blutswende](https://discuss.elastic.co/u/blutswende)\
**Post date:** [July 13, 2018, 9:24am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913/1 "2018-07-13T09:24:25Z")

</div>

Hi all,

i'm writing a new module to parse our own logfiles.

Now i'm stuck at a problem. With parsing the pipeline.json

My pipeline.json looks like:

```
{
    "processors": [
      {
        "grok": {
          "field": "message",
          "patterns": ["%{DATA:SAP_Order.BUKRS}\|%{DATA:SAP_Order.LIFNR}\|%{DATA:SAP_Order.LIFRE}\|%{DATA:SAP_Order.EBELN}\|%{DATA:SAP_Order.EBELP}\|%{DATA:SAP_Order.MATNR}\|%{DATA:SAP_Order.TXZ01}\|%{DATA:SAP_Order.IDNLF}\|%{DATA:SAP_Order.EAN11}\|%{DATA:SAP_Order.OREMG}\|%{DATA:SAP_Order.MEINS}\|%{DATA:SAP_Order.NETPR}\|%{DATA:SAP_Order.WAERS}\|%{DATA:SAP_Order.PEINH}\|%{DATA:SAP_Order.BPRME}\|%{DATA:SAP_Order.BPUMN}\|%{DATA:SAP_Order.MEINS2}\|%{DATA:SAP_Order.BPUMZ}\|%{DATA:SAP_Order.BPRME2}\|%{DATA:SAP_Order.WEBRE}"],
          "ignore_missing": true
        }
      }
    ]
  }

```

And the grok debugger is working with the sample data:

`0001|CPD_A||4500001239|00020|000000000000000023|Abfluss-Frei|||1,000 |ST|10,00 |EUR|1 |ST|1 |ST|1 |ST||`

But when i load my module in filebeat there is an error while parsing the pipeline.json because there is an error how i setup up the pipe delimiter `\|` that is not a valid json.

It's a valid JSON when i delete the backslash in front of the PIPE, but then GROK debugger is not working as expected.

Is there a way to use gsub with GROK and FILEBEAT to replace the PIPE with a SEMICOLON?  
How can i setup grok to use the PIPE delimiter and my pipeline.json is valid?

Best Regards  
Florian

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 13, 2018, 11:05am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913/2 "2018-07-13T11:05:44Z")

</div>

Hi @blutswende,

Try to escape the pipe delimiter with a double backslash (`\\|`).

---

<div class="post-metadata">

**Author:** ![blutswende](https://avatars.discourse-cdn.com/v4/letter/b/e99b99/32.png) [@blutswende](https://discuss.elastic.co/u/blutswende)\
**Post date:** [July 23, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913/3 "2018-07-23T09:10:50Z")

</div>

`\\|` doesn't work either

with the double backslash it's valid json string but the grok processor does not work

that's the output of the grok debugger in kibana

```
{
  "SAP_Order": {
    "WEBRE": ""
  }
}

```

WEBRE is the last field in row to parse

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 20, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-grok-processor-with-pipe-delimiter-not-working/139913/4 "2018-08-20T09:10:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.