# Modify the messages in the event in logstash

**URL:** <https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261>\
**Category:** Logstash\
**Created:** [February 19, 2016, 4:04pm UTC](https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261 "2016-02-19T16:04:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![viren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/viren/32/7859_2.png) [@viren](https://discuss.elastic.co/u/viren)\
**Post date:** [February 19, 2016, 4:04pm UTC](https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261/1 "2016-02-19T16:04:04Z")

</div>

Consider the message captured by Logstash (for an event) happen to look like this.

> Sending 1 **NEWLINE** Sending 2 **NEWLINE** Sending 4 **NEWLINE** Sending 5 **NEWLINE** Sending 6 **NEWLINE** Sending 7 **NEWLINE** Sending 8 **NEWLINE** Sending 9

Now is there a way to modify the message i.e replace the **NEWLINE** (above) with **\n** (a newline character) before sending it over to **Elasticsearch**

I tried using [filter split](https://www.elastic.co/guide/en/logstash/2.2/plugins-filters-split.html)

```
 filter {
    split {
      terminator => "NEWLINE"
    }
 }

```

But unfortunately it did not work. Although custom logs (added by me in the plugins) showed that the terminator was found and replaced but nothing appeared on Kibana Dashboard.

Thanks,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261/2 "2017-07-06T05:10:35Z")

</div>