Ignore Text and carriage return characters


(harsha) #1

Hello,
How can I manage log lines which have multiple /n and /r characters with Grok?
The log line here is a multiline and looking to replace the /r /n with "".
My filter looks like this :
filter{
grok {match => ["message","%{TIMESTAMP_ISO8601:timestamp}|%{GREEDYDATA:call_trace}"]}
mutate {gsub => ["call_trace", "\r\n", ""]}
}

But it doesnt work.

Any suggestions?
Thanks in advance


#2

You can use the strip option:

mutate {
  strip => ["call_trace"]
 }

(harsha) #3

I believe Strip is used only to remove trailing and leading white spaces. In my case I want to remove carriage returns/new lines


#4

It also removes \n. For \r, ou might want to test it


(harsha) #5

Just tried using strip on that field but no luck :frowning:


(harsha) #6

I managed to get it working by using the below filter.

filter{
mutate { gsub => [ "message", "[\n]", "" ] }
}

Thanks for the assistance.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.