# How to set /n as delimiter in dissect filter

**URL:** https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588
**Category:** Logstash
**Created:** [December 20, 2017, 8:49am UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588 "2017-12-20T08:49:33Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)
#### Post date: [December 20, 2017, 8:49am UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588/1 "2017-12-20T08:49:33Z")

</div>

Hi Elastic Team,

I need to filter of the field with \n as the delimiter in dissect filter.

Saw that logstash 6.0 has feature enabled.

config.support\_escapes: true

The filter what I have written is as follows;

```
 dissect {

                         mapping => {
                                balsdata => "%{}Privacy:%{Privacy:}\n%{}"
                       }

```

The above didn't work for me. Is it possible to do the above use case using dissect filter. If possible what is the changes to be made to filter.

Thanks  
George

---

<div class="post-metadata">

### Author: ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)
#### Post date: [January 4, 2018, 4:09pm UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588/2 "2018-01-04T16:09:31Z")

</div>

> [@George\_Cherian](#):
>
> of the field with \n as the delimiter in dissect filter.
> 
> Saw that logstash 6.0 has feature enabled.

I wonder if you found a solution to this issue. I am having a similar challenge using config.support\_escapes: true

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 4, 2018, 5:14pm UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588/3 "2018-01-04T17:14:28Z")

</div>

You can use an actual newline but there is a bug about this.  
e.g.

```auto
input {
  generator {
    message => "<Sep 26, 2017 7:56:38:265 PM> <c60ea685-4f68-454d-b0b3-4b7279a19f1e-00000090> <Bte_NsketefJerlsw_Vlfsirb_1_1> <CidhoegLsi5hs: KFSDbpdgBrvkdhsny> <ndygkcvsdwifg> <mht> <qwe.rtyuio.aYre.qazxswedcvfrt.fvb.bo.MNBVzxcvLkjhgfdsa> <run>
 <QWERTY: qwerty.qwerty.qwerty
  qwerty
  qwerty
  qwerty
>"
    count => 1
  }
}

filter {
  dissect {
    mapping => {
      message => '<%{time}> <%{data1}> <%{data2}> <%{data3}> <%{data4}> <%{data5}> <%{data6}> <%{data7}>
 <%{data8}>%{rest}'
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

```

notice the multiline single quoted string - for the `message => ''` line.  
This bug is preventing it really working though. [https://github.com/logstash-plugins/logstash-filter-dissect/issues/47](https://github.com/logstash-plugins/logstash-filter-dissect/issues/47)

---

<div class="post-metadata">

### Author: ![George\_Cherian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_cherian/32/25879_2.png) [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)
#### Post date: [January 17, 2018, 10:39am UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588/4 "2018-01-17T10:39:25Z")

</div>

Hi ,

First of all ,thank you for your response and apologies for delayed reply.

I tried dissect filter as you suggested but it didn't work. My filter is as below:

```
 dissect {

                    mapping => {
                                balsdata => '%{}Privacy:%{Privacy:}
%{}'

```

and also I have made the below config change in logstash .yml:

config.support\_escapes: true

Please suggest if I have to try it out in a different way.

Thanks  
George

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 14, 2018, 10:39am UTC](https://discuss.elastic.co/t/how-to-set-n-as-delimiter-in-dissect-filter/112588/5 "2018-02-14T10:39:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
