# Trouble with \\n in dissect filter mapping

**URL:** https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353
**Category:** Logstash
**Created:** [July 3, 2018, 10:27am UTC](https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353 "2018-07-03T10:27:21Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [July 3, 2018, 10:27am UTC](https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353/1 "2018-07-03T10:27:22Z")

</div>

Hi,

I am using ELK GA 6.3.0. I use Logstash to read messages from Kafka as JSON. I have a message like;

```
<Mar 23, 2018 7:40:04:108 AM> <test_entry_1>\n <SEVERE: logline1\nlogline2\n>

```

I am using the dissect filter like;

```
dissect {
	mapping => {
		"message" => "<%{timestamp}> <%{entry1}>%{entry2}"
	}
}

```

This works fine. But it will make `entry2` like `\n <SEVERE: logline1\nlogline2\n>`. I would like to remove `\n` and `< >` from `entry2`, so that I changed the filter like;

```
dissect {
	mapping => {
		"message" => "<%{timestamp}> <%{entry1}>\n <%{entry2}\n>"
	}
}

```

But now, the result is incorrect, means, there will be `<` and `>` in `entry1` and the message is not getting dissected properly. Why is this happening and how to fix this?

Thanks.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 3, 2018, 6:26pm UTC](https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353/2 "2018-07-03T18:26:04Z")

</div>

I do not understand dissect well enough to say why it happens, but you could move forward using

```
    mutate { gsub => ["entry2", "[><]", "", "entry2", "
", " " ] }

```

🙂

---

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [July 4, 2018, 5:03am UTC](https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353/3 "2018-07-04T05:03:45Z")

</div>

Cool, but that looks like my CPU usage will increase because of an additional filter 😉

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 1, 2018, 5:03am UTC](https://discuss.elastic.co/t/trouble-with-n-in-dissect-filter-mapping/138353/4 "2018-08-01T05:03:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.