# How to use \\n as a delimeter in dissect filter
**URL:** https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485
**Category:** Logstash
**Created:** [August 26, 2020, 4:14pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485 "2020-08-26T16:14:11Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 4:14pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/1 "2020-08-26T16:14:11Z")
Hi All,
dissect filter doesn't work when I use \n as a delimiter, it return error as
Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{test}\n%{test1}"
It works on any other delimeter but \n doesn't works.
Can anyone please suggest me work around of it
```
filter {
dissect {
mapping {
"message" => "%{test}\n%{test1}"
}
}
}
```
String to be matched is like
aaaa\nAAAA\nBBBB
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2020, 4:15pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/2 "2020-08-26T16:15:29Z")
Try using a liternal newline in the filter.
```
dissect {
mapping {
"message" => "%{test}
%{test1}"
}
}
```
---
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 5:05pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/3 "2020-08-26T17:05:06Z")
Hi @Badger
It didn't work, now throwing error like
> Failed to execute action {:id=\>:splunk, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Expected one of [\t\r\n], "#", "=\>" at line 59, column 27 (byte 2658) after filter {\n ... dissect {\n mapping ", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/reload.rb:53:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge\_state'"]}
code seems exactly the same as you suggested
> dissect {
> mapping {
> "message" =\> "%{test}
>
> %{test1}"
> }
> }
> 
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2020, 5:06pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/4 "2020-08-26T17:06:27Z")
That should be mapping =\> {, not mapping {
Also, it looks like you have a blank line in the middle of the mapping, which you probably do not want to.
---
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 5:17pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/5 "2020-08-26T17:17:17Z")
Sir, actually I want to use double backslashes \n\n as a delimeter.
I am going to apply this on windows event log ID: 4624 which is going to be parsed to extract main portions of event logs like
> dissect {
> mapping =\> {
> "message" =\> "%{?winlog\_header}\n\n%{winlog\_subject}\n\n%{winlog\_logon}\n\n%{winlog\_impersonation}\n\n%{winlog\_newlogon}\n\n%{winlog\_process}\n\n%{winlog\_network}\n\n%{winlog\_authentication}"
> }
> }
these main fields like **winlog\_subject** , **winlog\_process** will again be dissected with delimeter \n but the major portion has to be dissected with delimeter \n\n. That's why I showed here \n\n in the code and screenshot.
Thank you for your reply.
---
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 6:13pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/6 "2020-08-26T18:13:22Z")
Hi Sir,
Can I use this like as being shown in the screenshot.
```
dissect {
mapping => {
"message" => "%{?winlog_header}
%{winlog_subject}
%{winlog_logon}
%{winlog_impersonation}
%{winlog_newlogon}
%{winlog_process}
%{winlog_network}
%{winlog_authentication}"
"winlog_subject" => "%{?subject_header}
%{winlog_eventdata_SubjectUserSid}
%{winlog_eventdata_SubjectUserName}
%{winlog_eventdata_SubjectDomainName}
%{winlog_eventdata_SubjectLogonId}"
"winlog_logon" => "%{?winlog_logon_header}
%{winlog_eventdata_LogonType}
%{?winlog_eventdata_RestrictedAdminMode}
%{?winlog_eventdata_VirtualAccount}
%{?winlog_eventdata_ElevatedToken}"
"winlog_newlogon" => "%{?newlogon_header}
%{winlog_eventdata_TargetUserSid}
%{winlog_eventdata_TargetUserName}
%{winlog_eventdata_TargetDomainName}
%{winlog_eventdata_TargetLogonId}
%{winlog_eventdata_LinkedLogonID}
%{?winlog_eventdata_NetworkAccountName}
%{winlog_eventdata_NetworkAccountDomain}
%{winlog_eventdata_TargetLogonGuid}"
"winlog_process" => "%{?process_header}
%{winlog_eventdata_ProcessId}
%{winlog_eventdata_ProcessName}"
"winlog_network" => "%{?network_header}
%{?winlog_eventdata_WorkstationName}
%{winlog_eventdata_IpAddress}
%{winlog_eventdata_IpPort}"
}
}#end_dissect
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2020, 6:21pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/7 "2020-08-26T18:21:58Z")
That could work if each line starts with 14 spaces, otherwise you may want those left aligned.
---
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 6:30pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/8 "2020-08-26T18:30:49Z")
Sir, both of them didn't work. Above screenshot ^ and this one
dissect {
mapping =\> {
"message" =\> "%{?winlog\_header}
%{winlog\_subject}
%{winlog\_logon}
%{winlog\_impersonation}
%{winlog\_newlogon}
%{winlog\_process}
%{winlog\_network}
%{winlog\_authentication}"
"winlog\_subject" =\> "%{?subject\_header}
%{winlog\_eventdata\_SubjectUserSid}
%{winlog\_eventdata\_SubjectUserName}
%{winlog\_eventdata\_SubjectDomainName}
%{winlog\_eventdata\_SubjectLogonId}"
"winlog\_logon" =\> "%{?winlog\_logon\_header}
%{winlog\_eventdata\_LogonType}
%{?winlog\_eventdata\_RestrictedAdminMode}
%{?winlog\_eventdata\_VirtualAccount}
%{?winlog\_eventdata\_ElevatedToken}"
"winlog\_newlogon" =\> "%{?newlogon\_header}
%{winlog\_eventdata\_TargetUserSid}
%{winlog\_eventdata\_TargetUserName}
%{winlog\_eventdata\_TargetDomainName}
%{winlog\_eventdata\_TargetLogonId}
%{winlog\_eventdata\_LinkedLogonID}
%{?winlog\_eventdata\_NetworkAccountName}
%{winlog\_eventdata\_NetworkAccountDomain}
%{winlog\_eventdata\_TargetLogonGuid}"
"winlog\_process" =\> "%{?process\_header}
%{winlog\_eventdata\_ProcessId}
%{winlog\_eventdata\_ProcessName}"
"winlog\_network" =\> "%{?network\_header}
%{?winlog\_eventdata\_WorkstationName}
%{winlog\_eventdata\_IpAddress}
%{winlog\_eventdata\_IpPort}"
}
}#end\_dissect
**Thowing error ..**
][WARN][org.logstash.dissect.Dissector][splunk][19a778015acfcec74d96e1de54ccc439245a8b4f8149804f46cbac81c9d9b8d3] Dissector mapping, pattern not found
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2020, 7:12pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/9 "2020-08-26T19:12:15Z")
I suggest you start with
> [@shani](#):
>
> ```auto
> dissect {
> mapping => {
> "message" => "%{?winlog_header}
>
> %{}"
> }
>
> ```
then add one line at a time to the mapping to consume additional parts of the message.
---
### Author:  [@shani](https://discuss.elastic.co/u/shani)
#### Post date: [August 26, 2020, 7:55pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/10 "2020-08-26T19:55:49Z")
Thank you. It's working fine
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2020, 7:56pm UTC](https://discuss.elastic.co/t/how-to-use-n-as-a-delimeter-in-dissect-filter/246485/11 "2020-09-23T19:56:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.