# SNOW events additiona\_info field contains \\r\\n or \\n or \\t\\r\\n

**URL:** <https://discuss.elastic.co/t/snow-events-additiona-info-field-contains-r-n-or-n-or-t-r-n/239686>\
**Category:** Elasticsearch\
**Created:** [July 2, 2020, 5:17pm UTC](https://discuss.elastic.co/t/snow-events-additiona-info-field-contains-r-n-or-n-or-t-r-n/239686 "2020-07-02T17:17:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [July 2, 2020, 5:17pm UTC](https://discuss.elastic.co/t/snow-events-additiona-info-field-contains-r-n-or-n-or-t-r-n/239686/1 "2020-07-02T17:17:44Z")

</div>

I am trying to find a way to filter out \r\n and \r\r\n from an array. After I split the results field I have an array with addional\_info. Unfortunately there are several sources for this additional info and depending on the source it can have carraige returns line returns or tab in the data.

I need a way to replace these characters with a space so that I split will work. I need to do this obvously before the split. My issue is , it will usually work but sends a ton of error messages to the logs. I need a way to clean this up or tell logstash not to send the alerts to the logfile.

```
_type

```

\_doc

additional.info  
{"sysUpTime":"52 days, 0:28:11.00","iso.org.dod.internet.private.enterprises.11536.1.5.1.1":"Logs\padr.log","int\_ev\_type":"SNMP","iso.org.dod.internet.private.enterprises.11536.1.5.1.2":"","iso.org.dod.internet.private.enterprises.11536.1.5.1.3":"[02/07/2020 13:09:35.316122] :: GetPADRWorkingDirectory returned [D:\Program Files (x86)\PrivateArk\PADR\Conf] \r\n","snmpTrapOID":"iso.org.dod.internet.private.enterprises.11536.3.6.5000"}

bucket  
10

---

<div class="post-metadata">

**Author:** ![genehunter29009](https://avatars.discourse-cdn.com/v4/letter/g/45deac/32.png) [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\
**Post date:** [July 20, 2020, 6:02pm UTC](https://discuss.elastic.co/t/snow-events-additiona-info-field-contains-r-n-or-n-or-t-r-n/239686/2 "2020-07-20T18:02:19Z")

</div>

Found this fix

###############################################################################

## additional\_info clean up \r\n\t from data

################################################################################  
json {  
source =\> "additional.info"  
target =\> "info"  
}  
mutate { gsub =\> ["info", "\\n", " "] }  
mutate { gsub =\> ["info", "\\r", " "] }  
mutate { gsub =\> ["info", "\\t", " "] }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2020, 6:02pm UTC](https://discuss.elastic.co/t/snow-events-additiona-info-field-contains-r-n-or-n-or-t-r-n/239686/3 "2020-08-17T18:02:40Z")

</div>

Closed on August 17, 2020, 6:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.