# Help sanitizing new lines

**URL:** <https://discuss.elastic.co/t/help-sanitizing-new-lines/373823>\
**Category:** Logstash\
**Created:** [January 29, 2025, 1:15pm UTC](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823 "2025-01-29T13:15:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_e/32/47012_2.png) [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\
**Post date:** [January 29, 2025, 1:15pm UTC](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823/1 "2025-01-29T13:15:30Z")

</div>

Hi there,

I need help with what I thought was a very simple issue, but turns out it isn't. I have updated from logstash 7.x to 8.x, and even though all of my tests have passed correctly, I found several issues with one of the pipelines that integrates firewall logs using a modified version of PFelk. It is more or less working now, but I still don't manage to receive logs from the "haproxy" side. I believe the problem is due to some new lines in the message. I don't what's changed and why they are a problem now, but I can't get rid of them. I have tried all the solutions proposed in similar posts, but none work.

Here's a sample log that is causing trouble:

```auto
"<30>Jan 29 10:29:46 haproxy[1087089]: 127.0.0.1:37672 [29/Jan/2025:10:29:46.258] HAProxyStats HAProxyStats/<STATS> 0/0/0/0/0 200 342208 - - LR-- 1/1/0/0/0 0/0 \"GET /stats HTTP/1.1\"\n"

```

In my tests, this type of input is discarded, not even recognized by logstash. In production it simply fails with a \_grokparsefailure. I tried adding the gsub filter to remove "\n", but it doesn't do anything unless I escape the "\n" in the original message.

Any ideas on how I could solve this?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [January 29, 2025, 1:27pm UTC](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823/2 "2025-01-29T13:27:12Z")

</div>

> [@Jose\_E](#):
>
> `127.0.0.1:37672 [29/Jan/2025:10:29:46.258`

Hola Jose,

Could you please check below post incase if it is helpful?

> [@Haproxy grokparsefailure](https://discuss.elastic.co/t/haproxy-grokparsefailure/229899):
>
> HAPRoxy Logstash Grok Parse Failure This is my log entry from HAProxy (pfsense haproxy package) "message": "\<142\>Apr 27 02:24:00 haproxy[37279]: 162.158.155.249:54250 [27/Apr/2020:02:24:00.173] shared-frontend-merged~ example.com\_ipvANY/emaple.com 0/0/192/170/363 200 3411 - - ---- 2/2/0/1/0 0/0 \"GET / HTTP/1.1\"\n", I have default grok enabled in logstash but i still get log parse failure. is it because the logs have appended syslog header ? grok { match =\> { "message" =\> "%{HAPROXYHTTP}" …

Also could you please share if post upgrade these records are discarded by logstash & what is the error message we see in logstash?

Thanks!!

---

<div class="post-metadata">

**Author:** ![Jose\_E](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_e/32/47012_2.png) [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\
**Post date:** [February 3, 2025, 1:50pm UTC](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823/3 "2025-02-03T13:50:08Z")

</div>

Turns out it was all a very funny mistake. I had the version pinned, so it did not upgrade to 8.X; however, my pipelines were changed to fit 8.X and changes made to pfelk... So yeah, that went very wrong... After I noticed and upgraded, everything slowly fell into place.

Just as a future confirmation, the mutate to remove "new lines" did work.