Gsub replacing \\n with \n

[saramali]

I want to replace '\\n' with '\n'

i am using the gsub method but cannot replace

ruby
{

code => "@mystring=event.get('stockLines');
@mystring=@mystring.gsub('\\n', '\n');"

}

[saramali]

@magnusbaeck

[AurelienG]

I'm not sure but I think you should use gsub inside a mutate filter instead of trying to write some ruby code. See https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub
Anyway, I think the problem is with the double backslash: the first backslash is actually used to escape the second backslash so you lack one backslash. And in the result you expect "\n", you also have to escape that backslash, for it to become literal.
I would try something like:

filter {
  mutate {
    gsub => [
      "stockLines", "\\\\n", "\\n",
    ]
  }
}

If it doesn't work, please tell us what you've tried and what the result was.

Edit: I also found this, if you really prefer using Ruby: https://www.linuxtopia.org/online_books/programming_books/ruby_tutorial/Ruby_Standard_Types_Backslash_Sequences_in_the_Substitution.html

[saramali]

Thanks for writing.
I tried using mutate as you suggested. But still the issue is there, I can't seem to remove the \\n from my log.

ruby
{
code => "@stockLines = @stockLines.to_s + event.get('stockInformation') + '\n';
if event.get('stockInformation') =~ /Time taken for Variance Price Calculations/
event.set('stockLog', @stockLines);
event.set('prev_stock_id', @@map['document_id' + @@map['currentStockNumber']]);
@stockLines='';
end"
}

mutate 
{
gsub => [
  "stockLog", "\\\\n", "\\n"
]
}

[tgaudin]

You can take a look at this topic, I had a similar issue with backslashes and the workaround is a bit ugly Parse nested key-values

[AurelienG]

Your 'stockInformation' field already ends with a backslash, right? I guess that's why you have \\n in the end. Maybe you can try to remove that backslash first with:

mutate {
   gsub => [
     "stockInformation", "[\\]", " "
   ]
}

And then add the "\n" to your stockLog.

[saramali]

Well I want to add a new line character at the end of each stockLine.

Therefore I concatenate it with the newline character.
@stockLines = @stockLines.to_s + event.get('stockInformation') + '\n'

But it concatenates \\n instead of \n. Therefore I was trying if I could substitute \\n with \n. I can't seem to do that anyway. I just want to concatenate a newline character at the end. Somehow \n is converted into \\n

[tgaudin]

In Ruby if you write a string with single quotes it will escape any \n.
You need to concatenate with "\n", eg:
@stockLines = @stockLines.to_s + event.get('stockInformation') + "\n"

[saramali]

How can I do that in double qoutes, assuming the

code => tag opens with a double qoute too.

[Badger]

Use single quotes

[tgaudin]

You could either change the code => "<ruby code>" to use single quotes, and change all quotes in your ruby code to double quotes (code => '@stockLines = @stockLines.to_s + event.get("stockInformation") + "\n"; <other code>').
Or you could extract the ruby script to a separate file, and link to it with path => "/path/to/script.rb".