elastic / elastic/logstash

KV retains line break (\n)

Open
#5,378 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

So ran into this problem that is flooding the logs. Doesn't seem to affect functionality & actual indexing - or maybe it is - I don't know. Just 80gb of logstash logs a day.

These are not multiline events.

```
{:timestamp=>"2016-05-26T14:17:13.352000-0700", :message=>"Failed action. ", :status=>400, :action=>["index", {:_id=>nil,
....[super long snip]....
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [s2_tm]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2016-05-26T14:17:13.237-0700\n\" is malformed at \"\n\""}}}}, :level=>:warn}

```

The way I get the KV's is:

```
udp {
port => 9200
type => "site_access"
}

```

`%{GREEDYDATA:TOKEN_VARS}
`
and

```
kv {
source => "TOKEN_VARS"
field_split => "!"
}
```

It just so happens that it's at the end of the log line, and it picks up the \n break. I tried gsub on TOKEN_VARS & trim in kv with no luck on getting rid of it.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.