# Splitting JSON extracted fields for new-line behaves incorrectly vs JSON original message

**URL:** <https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688>\
**Category:** Logstash\
**Created:** [October 11, 2020, 7:43pm UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688 "2020-10-11T19:43:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [October 11, 2020, 7:43pm UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688/1 "2020-10-11T19:43:24Z")

</div>

I've an example dataset as below

```auto
{
  "org": "COMPANY11",
  "department": {
    "name": "Human Resources",
    "id": "HR"
  },
  "http_request": "Host: www.something.co.uk\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/5.0 (Linux; Android 8.1.0; DUB-LX1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Mobile Safari/537.36\r\nAccept: image/webp,image/apng,image/*,*/*;q=0.8\r\nSec-Fetch-Site: same-origin\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Dest: image\r\nReferer: https://www.something.co.uk/assets/styles.css?20201008.2\r\nAccept-Encoding: gzip, deflate, br\r\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\r\n",
  "src_ip": "217.182.97.145"
}

```

if I use a `split` on `message` it works. But if I extract `message` using JSON filter and then do on the extracted field the `\r\n` doesn't behave as it should be. I'm trying to split the `http_request` into key-value pairs based on `:` and `\r\n` Please find my pipeline config

```auto

input {
    file {
        path => "/tmp/json_sample.json"
        start_position => beginning
        sincedb_path => "/dev/null"
        exclude => "*.gz"
        codec => multiline {
            pattern => "^{$"
            negate => "true"
            what => "previous"
        }
    }
}

filter {
  json{
    source => "message"
  }
# did not work
 mutate {
    split => { "http_request" => "\\r\\n"}
 }
# did not work
  mutate {
    gsub => ["http_request", "[\\\\]r", "rrr" ]
    gsub => ["http_request", "[\\\\]n", "nnn" ]
  }

# did not work
    kv {
      field_split_pattern => "\\r\\n"
      value_split_pattern => ": "
      source => "http_request"
    }
}

output {
    stdout {
        codec => rubydebug
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 11, 2020, 9:18pm UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688/2 "2020-10-11T21:18:25Z")

</div>

If the http\_request field contains the literal strings \r\n then

```
    mutate { gsub => ["http_request", "\r", ""] }
    mutate {
        split => { "http_request" => "
" }

```

To use kv you can

```
json { source => "message" remove_field => ["message"] }
mutate { gsub => ["http_request", "\r", ""] }
kv { field_split_pattern => "\n" value_split_pattern => ": " source => "http_request" }

```

would work.

---

<div class="post-metadata">

**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\
**Post date:** [October 12, 2020, 7:46am UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688/3 "2020-10-12T07:46:15Z")

</div>

didn't work Badger.  
somehow after doing the `json` filter, the `\r\n` is not what it is supposed to be. can't take it out with any of the regex I've tried above

but before/pre `json` filter, I can do the gsub fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2020, 7:46am UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688/4 "2020-11-09T07:46:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.