KV retains line break (\n)
- Dominant language
- Java
- Stars
- 14.9k
- Forks
- 3.5k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 63
Description
So ran into this problem that is flooding the logs. Doesn't seem to affect functionality & actual indexing - or maybe it is - I don't know. Just 80gb of logstash logs a day.
These are not multiline events.
```
{:timestamp=>"2016-05-26T14:17:13.352000-0700", :message=>"Failed action. ", :status=>400, :action=>["index", {:_id=>nil,
....[super long snip]....
"status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [s2_tm]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2016-05-26T14:17:13.237-0700\n\" is malformed at \"\n\""}}}}, :level=>:warn}
```
The way I get the KV's is:
```
udp {
port => 9200
type => "site_access"
}
```
`%{GREEDYDATA:TOKEN_VARS}
`
and
```
kv {
source => "TOKEN_VARS"
field_split => "!"
}
```
It just so happens that it's at the end of the log line, and it picks up the \n break. I tried gsub on TOKEN_VARS & trim in kv with no luck on getting rid of it.
Contributor guide
Assessment
This issue has not been assessed yet.