# Logstash parse out \\r and \\t entries **URL:** \ **Category:** Logstash\ **Created:** [August 10, 2018, 3:11pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888 "2018-08-10T15:11:38Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 3:11pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/1 "2018-08-10T15:11:38Z")
Hello there, I am having some issues with parsing out some logstash data. In my data, I have \r's and \t's that are floating around that I need to get rid of. `\tLogon ID:\t\t(0x2,0x50722C31)\r` I started trying to remove the \t's first so I made a kv ``` kv { source => [message] trim => "\t" } ``` but I found out that it's some sort of regular expression and I had to use another \ to escape the first one. I tried instead using `\\t` but then it removed all lower case t's and the 's instead of just the \t's :sad: I also tried `\\\t` but that only took out the \ and left the t's. Lastly, I tried `\\\\t` but it took me back to the `\\t` results. If anyone could offer help, that would be appreciated. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 10, 2018, 4:06pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/2 "2018-08-10T16:06:10Z")
In your data do you have tab characters or literal backslash lowercase tee? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 4:22pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/3 "2018-08-10T16:22:21Z")
There are literal tabs in the data. I think it's being converted into json and is shipped as pain text, which is making this complicated. I have NxLog shipping the logs to LogStash. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 10, 2018, 4:39pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/4 "2018-08-10T16:39:45Z")
Assuming you are on UNIX, you can put a literal tab (ctrl/v ctrl/I) or carriage return (ctrl/v ctrl/m) in the logstash configuration file. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 4:48pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/5 "2018-08-10T16:48:28Z")
I can try. They data doesn't show up in elasticsearch with tabs though, even if I have a blank filter just to see how the data shows up. It shows up as `\tUser Name:\t\taccount\r` so there isn't literal spaces If I click on the JSON part of the data, there is an extra \ at each one. `\\tUser Name:\\t\\taccount\\r` I'll give your suggestion a go though. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 4:53pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/6 "2018-08-10T16:53:31Z")
Just tried your suggestion and it didn't seem to do any parsing. Assuming you mean pressing `ctrl and v then ctrl and l` it showed up as `^V^L` in the config file. I am using CentOS btw ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 10, 2018, 5:02pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/7 "2018-08-10T17:02:36Z")
Tab is ctrl/eye, not ctrl/ell. I am assuming that lnext is set to ctrl/v. Does 'stty -a' show you that? ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 5:17pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/8 "2018-08-10T17:17:27Z")
stty -a shows `lnext = ^V` I substituted the i's instead of the L's and reran the services, but the \t's and \r's are still showing ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 5:19pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/9 "2018-08-10T17:19:40Z")
Here is the entry, in JSON, inside elastic. Not sure if this helps or not `"User Logoff:\\r,\\r,\\tUser Name:\\tadmin\\r,\\r,\\tDomain:\\t\\tsrv-tst\\r,\\r,\\tLogon ID:\\t\\t(0x2,0x50722C31)\\r,\\r,\\tLogon Type:\\t5\\r,"` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 10, 2018, 5:35pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/10 "2018-08-10T17:35:33Z")
> [@motts](#): > > "User Logoff:\r,\r,\tUser Name:\tadmin\r,\r,\tDomain:\t\tsrv-tst\r,\r,\tLogon ID:\t\t(0x2,0x50722C31)\r,\r,\tLogon Type:\t5\r," That really suggests to me that you have backslash + r or t in your message. ``` mutate { gsub => ["message", "\\[rt]", "" ] } ``` would cure that. ---
**Author:** ![motts](https://avatars.discourse-cdn.com/v4/letter/m/839c29/32.png) [@motts](https://discuss.elastic.co/u/motts)\ **Post date:** [August 10, 2018, 5:54pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/11 "2018-08-10T17:54:33Z")
Yeah I guess that what I was trying to say. In the original CSV, there are new lines, but NxLog seemed to replace those lines with plain-text JSON formatting for those, so the tabs were \t and the returns were \r, but as plain-text instead of code. That worked like a charm @Badger. You are the boss! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 7, 2018, 5:54pm UTC](https://discuss.elastic.co/t/logstash-parse-out-r-and-t-entries/143888/12 "2018-09-07T17:54:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.