Syslog with line Codec delimiter change fail the grok parser

H all,
when using this configuration:

    input {
      syslog {
        port => 1337
        host => ""
        codec => line {
          delimiter => "\n"

with kv filter it fails with the tag "_grokparsefailure_sysloginput" although the default delimiter is "\n", I am trying to change the delimiter to "\r\n" but I can't even work with "\n" as a delimiter, it looks like it is trying to split lines by "\n" and also "\n", but when staying on default it is not spliting lines as "\n".


              "facility" => 0,
        "facility_label" => "kernel",
            "@timestamp" => 2020-04-20T09:19:49.637Z,
              "severity" => 0,
        "severity_label" => "Emergency",
              "priority" => 0,
               "message" => "Accept-Encoding: gzip, deflate",
                  "tags" => [
            [0] "_grokparsefailure_sysloginput"
                  "host" => "",
              "@version" => "1"

Is there any other way to trim \r from the message (it causing me use a workaround on the kv filter) ?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.