# Using the escape character

**URL:** <https://discuss.elastic.co/t/using-the-escape-character/25838>\
**Category:** Logstash\
**Created:** [July 18, 2015, 3:22am UTC](https://discuss.elastic.co/t/using-the-escape-character/25838 "2015-07-18T03:22:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wstlk](https://avatars.discourse-cdn.com/v4/letter/w/e47774/32.png) [@wstlk](https://discuss.elastic.co/u/wstlk)\
**Post date:** [July 18, 2015, 3:22am UTC](https://discuss.elastic.co/t/using-the-escape-character/25838/1 "2015-07-18T03:22:18Z")

</div>

How or what syntax is the standard for using the escape character in a literal?

`"\\"` tells me it doesn't apply to the following case

here I have a message string

```
"client 1.1.1.1#44582 (abc.com): query (cache) 'abc.com/A/IN' denied\n"

```

but shouldn't one be able to later use `"\\n"` for the ending of the string? I'd like to not to include the string `"\n"` as part of `<?bindmsg>` -- and I have things working, though here when it doesn't pass grok fails.(it fails for `"\\n"`)

```
"client %{HOSTNAME:dcip}#([0-9]+) \(%{HOSTNAME:qry}\): ([\S]+) ([\S]+) ('[\S]+)/(?<qrystring>[^/]+)/([A-Za-z]+') (?<bindmsg>[\S]+)\n"
"client %{HOSTNAME:dcip}#([0-9]+) \(%{HOSTNAME:qry}\): ([\S]+) ([\S]+) ('[\S]+)/(?<qrystring>[^/]+)/([A-Za-z]+') ((?<bindmsg>[\S]+)\\n)"

```

the fields get picked up nicely though I do now know why it is `"\n"` -- I'm used to using `"\\"` in other languages so this seems a bit counter intuitive

thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:34am UTC](https://discuss.elastic.co/t/using-the-escape-character/25838/2 "2017-07-06T05:34:19Z")

</div>