# How to remove a line break from a field in logstash

**URL:** <https://discuss.elastic.co/t/how-to-remove-a-line-break-from-a-field-in-logstash/183572>\
**Category:** Logstash\
**Created:** [May 30, 2019, 3:59pm UTC](https://discuss.elastic.co/t/how-to-remove-a-line-break-from-a-field-in-logstash/183572 "2019-05-30T15:59:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carlos.limaElaw](https://avatars.discourse-cdn.com/v4/letter/c/ec9cab/32.png) [@Carlos.limaElaw](https://discuss.elastic.co/u/Carlos.limaElaw)\
**Post date:** [May 30, 2019, 3:59pm UTC](https://discuss.elastic.co/t/how-to-remove-a-line-break-from-a-field-in-logstash/183572/1 "2019-05-30T15:59:11Z")

</div>

Hello, everyone!

I'm trying to ingest a csv like this in logstash using csv filter:

> column1;column2;column3;column4;column5;  
> 201905; DADOS PARA O CADASTRO;2019-05-22 09:48:08;2019-05-22 10:06:05;"Criar acesso para  
> NOME  
> CPF  
> E-MAIL  
> Larissa Santana Garcia  
> 094.350.614-00  
> larissa.garcia@wsb.adv.br  
> Maria das Dores Alves de Menezes  
> 107.243.164-50  
> maria.menezes@wsb.adv.br  
> Ana Luiza Lacerda Cunha  
> 089.140.404-02  
> ana.lacerda@wsb.adv.br  
> Ana Caroline Araújo de Andrade  
> 700.856.754-58  
> ana.araujo@wsb.adv.br";

How you can see, there`s a line break after "Criar acesso para" and the logstash consider a line break as a new event.

The error in convert:

> [2019-05-30T12:24:40,368][WARN][logstash.filters.csv] Error parsing csv {:field=\>"message", :source=\>"2019052238000853;RES: DADOS PARA O CADASTRO DO ELAW;2019-05-22 09:48:08;2019-05-22 10:06:05;;Consultores;new;leandro.coelho@viavarejo.com.br;Via Varejo;ADM::CRIA├ç├âO DE USU├üRIO;SLA - Medio;Ajuste/Corre├º├úo em Configura├º├Áes;rogerio.owsiany;0;2;Leliana Souza;;Sem atua├º├úo;;Sem atua├º├úo;"Criar acesso para\r", :exception=\>#\<CSV::MalformedCSVError: Unclosed quoted field on line 1.\>}

And the logstash create a event to "NOME", "CPF", ETC....

I tried:

> mutate {  
> gsub =\> ["message", "\r", ""]  
> gsub =\> ["Resumo do chamado", "\r", ""]  
> }

but no sucess....

Some idea what to do?

Thanks!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 30, 2019, 4:18pm UTC](https://discuss.elastic.co/t/how-to-remove-a-line-break-from-a-field-in-logstash/183572/2 "2019-05-30T16:18:54Z")

</div>

Unless you have config.support\_escapes enables you do not refer to a newline using \r, you have to use a literal newline in the configuration:

```
mutate { gsub => [ "message", "
", "" ] }

```

But that is not going to fix your problem, which is that you need to consume multiple lines as a single event. You may be able to do that using a multiline codec on the input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2019, 5:28pm UTC](https://discuss.elastic.co/t/how-to-remove-a-line-break-from-a-field-in-logstash/183572/4 "2019-06-27T17:28:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.