# Syslog with line Codec delimiter change fail the grok parser

**URL:** <https://discuss.elastic.co/t/syslog-with-line-codec-delimiter-change-fail-the-grok-parser/228829>\
**Category:** Logstash\
**Created:** [April 20, 2020, 9:43am UTC](https://discuss.elastic.co/t/syslog-with-line-codec-delimiter-change-fail-the-grok-parser/228829 "2020-04-20T09:43:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![realgam3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/realgam3/32/66622_2.png) [@realgam3](https://discuss.elastic.co/u/realgam3)\
**Post date:** [April 20, 2020, 9:43am UTC](https://discuss.elastic.co/t/syslog-with-line-codec-delimiter-change-fail-the-grok-parser/228829/1 "2020-04-20T09:43:02Z")

</div>

H all,  
when using this configuration:

```auto
    input {
      syslog {
        port => 1337
        host => "0.0.0.0"
        codec => line {
          delimiter => "\n"
        }
      }
    }

```

with kv filter it fails with the tag "\_grokparsefailure\_sysloginput" although the default delimiter is "\n", I am trying to change the delimiter to "\r\n" but I can't even work with "\n" as a delimiter, it looks like it is trying to split lines by "\n" and also "\n", but when staying on default it is not spliting lines as "\n".

Error:

```auto
    {
              "facility" => 0,
        "facility_label" => "kernel",
            "@timestamp" => 2020-04-20T09:19:49.637Z,
              "severity" => 0,
        "severity_label" => "Emergency",
              "priority" => 0,
               "message" => "Accept-Encoding: gzip, deflate",
                  "tags" => [
            [0] "_grokparsefailure_sysloginput"
        ],
                  "host" => "1.3.3.7",
              "@version" => "1"
    }

```

Is there any other way to trim \r from the message (it causing me use a workaround on the kv filter) ?

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2020, 9:43am UTC](https://discuss.elastic.co/t/syslog-with-line-codec-delimiter-change-fail-the-grok-parser/228829/2 "2020-05-18T09:43:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.