Ignore Text and carriage return characters

Elastic Stack Logstash
1

Hello,
How can I manage log lines which have multiple /n and /r characters with Grok?
The log line here is a multiline and looking to replace the /r /n with "".
My filter looks like this :
filter{
grok {match => ["message","%{TIMESTAMP_ISO8601:timestamp}|%{GREEDYDATA:call_trace}"]}
mutate {gsub => ["call_trace", "\r\n", ""]}
}

But it doesnt work.

Any suggestions?
Thanks in advance

1 Like
2

You can use the strip option:

mutate {
  strip => ["call_trace"]
 }
3

I believe Strip is used only to remove trailing and leading white spaces. In my case I want to remove carriage returns/new lines

4

It also removes \n. For \r, ou might want to test it

5

Just tried using strip on that field but no luck :frowning:

6

I managed to get it working by using the below filter.

filter{
mutate { gsub => [ "message", "[\n]", "" ] }
}

Thanks for the assistance.

3 Likes
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.