Replace my \r\n with a new line using mutate gsub

Elastic Stack Logstash
1

Hi All

I have a csv data in this format

{
"message" : "value1,value2,value3\r\nvalue4,value5,value6"
}

My expected result is

{
"message" : "value1,value2,value3
value4,value5,value6"
}

I have tried mutate gsub, but it does not work

 mutate { gsub => [ 'message', '\r\n', '
'] }

It gives me again same \n. how to make this work?
Finally i want to use csv filter and convert everything to json. But csv filter should have new line data

Thanks

2

What are you using to view the result? If you use rubydebug then a literal newline character will be displayed as \n, not as a newline. The same is true of some other tools.

3

Hi @Badger thanks for your reply. With rubydebug i get value as \\n
There is double backslash and this is not working with csv filter

4

Do you actually have \r\n in your message or just \n? Perhaps you need

mutate { gsub => [ 'message', '[\r\n]', '
'] }
5

Hi @Badger .This didn't work, after applying csv filter it reads only the last record/last line.Do you have any idea why it is reading only one line

I have csv data with 50K records. So i do not want to use split filter as well. Because split filter takes lot of time
If this works i can straight use csv filter

6

Hi @Badger i think its doing correct replacement of gsub, but somehow it reads only one line with csv filter. How can we fix this?

7

If you use

output { stdout { codec => rubydebug } }

what does an event look like?

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.