# Ignore Text and carriage return characters

**URL:** <https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278>\
**Category:** Logstash\
**Created:** [May 10, 2017, 3:22pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278 "2017-05-10T15:22:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![harshavardan25000](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\
**Post date:** [May 10, 2017, 3:22pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/1 "2017-05-10T15:22:08Z")

</div>

Hello,  
How can I manage log lines which have multiple /n and /r characters with Grok?  
The log line here is a multiline and looking to replace the /r /n with "".  
My filter looks like this :  
filter{  
grok {match =\> ["message","%{TIMESTAMP\_ISO8601:timestamp}|%{GREEDYDATA:call\_trace}"]}  
mutate {gsub =\> ["call\_trace", "\r\n", ""]}   
}

But it doesnt work.

Any suggestions?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 11, 2017, 7:05am UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/2 "2017-05-11T07:05:32Z")

</div>

You can use the strip option:

```auto
mutate {
  strip => ["call_trace"]
 }

```

---

<div class="post-metadata">

**Author:** ![harshavardan25000](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\
**Post date:** [May 11, 2017, 11:57am UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/3 "2017-05-11T11:57:57Z")

</div>

I believe Strip is used only to remove trailing and leading white spaces. In my case I want to remove carriage returns/new lines

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 11, 2017, 11:59am UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/4 "2017-05-11T11:59:29Z")

</div>

It also removes \n. For \r, ou might want to test it

---

<div class="post-metadata">

**Author:** ![harshavardan25000](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\
**Post date:** [May 11, 2017, 12:03pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/5 "2017-05-11T12:03:45Z")

</div>

Just tried using strip on that field but no luck ☹

---

<div class="post-metadata">

**Author:** ![harshavardan25000](https://avatars.discourse-cdn.com/v4/letter/h/c4cdca/32.png) [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\
**Post date:** [May 11, 2017, 4:31pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/6 "2017-05-11T16:31:04Z")

</div>

I managed to get it working by using the below filter.

filter{  
mutate { gsub =\> ["message", "[\n]", "" ] }  
}

Thanks for the assistance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2017, 4:36pm UTC](https://discuss.elastic.co/t/ignore-text-and-carriage-return-characters/85278/7 "2017-06-08T16:36:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.