# Kv & new line (\\n) errors

**URL:** <https://discuss.elastic.co/t/kv-new-line-n-errors/51098>\
**Category:** Logstash\
**Created:** [May 26, 2016, 9:57pm UTC](https://discuss.elastic.co/t/kv-new-line-n-errors/51098 "2016-05-26T21:57:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Romey-Rome](https://avatars.discourse-cdn.com/v4/letter/r/4da419/32.png) [@Romey-Rome](https://discuss.elastic.co/u/Romey-Rome)\
**Post date:** [May 26, 2016, 9:57pm UTC](https://discuss.elastic.co/t/kv-new-line-n-errors/51098/1 "2016-05-26T21:57:34Z")

</div>

So ran into this problem that is flooding the logs. Doesn't seem to affect functionality & actual indexing. Just 80gb of logstash logs a day.

`{:timestamp=>"2016-05-26T14:17:13.352000-0700", :message=>"Failed action. ", :status=>400, :action=>["index", {:_id=>nil, ....[super long snip].... "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [s2_tm]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2016-05-26T14:17:13.237-0700\n\" is malformed at \"\n\""}}}}, :level=>:warn}`

The way I get the KV's is:  
`%{GREEDYDATA:TOKEN_VARS}`

and  
`kv { source => "TOKEN_VARS" field_split => "!" }`

It just so happens that it's at the end of the log line, and it picks up the \n break. I tried gsub on TOKEN\_VARS & trim in kv with no luck on getting rid of it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/kv-new-line-n-errors/51098/2 "2017-07-06T04:55:58Z")

</div>

Closed on July 6, 2017, 4:55am UTC