how to remove the special character '\\\n' with vector's vrl

[omyhub]

filebeat (multiline) ---> vector

vrl:

source = '''
. |= parse_regex!(.message, r'^(?P\d+-\d+-\d+ \d+:\d+:\d+.\d++\d+): (?P.+)$')
.timestamp = parse_timestamp(.timestamp, "%Y-%m-%d %H:%M:%S.%ms+%z") ?? now()
message_parts = split(.message, ", ", limit: 20)
structured = parse_key_value(message_parts[1], key_value_delimiter: ":", field_delimiter: ",") ?? {}
.message = replace(.message, r'\\n', " ")
. = merge(., structured)
'''

i get result blow

"message": "2022-06-28 08:45:45.241+0000: starting up libvirt version: 4.5.0, package: 36.el7_9.5 (CentOS BuildSystem http://bugs.centos.org, 2021-04-28-13:32:22, x86-01.bsys.centos.org), qemu version: 1.5.3 (qemu-kvm-1.5.3-175.el7_9.6), kernel: 3.10.0-1160.66.1.el7.x86_64, hostname: localhost.localdomain\nLC_ALL=C \\nPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \\nQEMU_AUDIO_DRV=none \\n/usr/libexec/qemu-kvm \\n-name centos7 \\n-S \\n-machine pc-i440fx-rhel7.0.0,accel=kvm,usb=off,dump-guest-core=off \\n-cpu Westmere-IBRS,+spec-ctrl,+ssbd \\n-m 2048 \\n-realtime mlock=off \\n-smp 1,sockets=1,cores=1,threads=1 \\n-uuid 4e165ef3-af3b-44fa-b5b5-61f3e3a4313b \\n-display none \\n-no-user-config \\n-nodefaults \\n-chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/domain-15-centos7/monitor.sock,server,nowait \\n-mon chardev=charmonitor,id=monitor,mode=control \\n-rtc base=utc,driftfix=slew \\n-global kvm-pit.lost_tick_policy=delay \\n-no-hpet \\n-no-shutdown \\n-global PIIX4_PM.disable_s3=1 \\n-global PIIX4_PM.disable_s4=1 \\n-boot strict=on \\n-device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x4.0x7 \\n-device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x4 \\n-device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x4.0x1 \\n-device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x4.0x2 \\n-device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 \\n-drive file=/data/testvm/centos7/centos7.qcow2,format=qcow2,if=none,id=drive-virtio-disk0 \\n-device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x6,drive=drive-virtio-disk0,id=virtio-disk0,bootindex=1 \\n-drive file=/data/testvm/centos7/centos7-1.qcow2,format=qcow2,if=none,id=drive-virtio-disk1 \\n-device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk1,id=virtio-disk1 \\n-drive if=none,id=drive-ide0-0-0,readonly=on \\n-device ide-cd,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \\n-netdev tap,fd=27,id=hostnet0,vhost=on,vhostfd=29 \\n-device virtio-net-pci,netdev=hostnet0,id=net0,mac=52:54:00:a5:a2:54,bus=pci.0,addr=0x3 \\n-chardev pty,id=charserial0 \\n-device isa-serial,chardev=charserial0,id=serial0 \\n-chardev socket,id=charchannel0,path=/var/lib/libvirt/qemu/channel/target/domain-15-centos7/org.qemu.guest_agent.0,server,nowait \\n-device virtserialport,bus=virtio-serial0.0,nr=1,chardev=charchannel0,id=channel0,name=org.qemu.guest_agent.0 \\n-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 \\n-object rng-random,id=objrng0,filename=/dev/urandom \\n-device virtio-rng-pci,rng=objrng0,id=rng0,bus=pci.0,addr=0x9 \\n-msg timestamp=on\nchar device redirected to /dev/pts/2 (label charserial0)",

[jszwedko]

Hi @omyhub !

replace!(.message, "\\n", " ")

Should work for you to replace \\n with a space.

[omyhub]

but it don't work , vector can't run
Jul 01 17:47:59 localhost.localdomain vector[11561]: │ ^^^^^^^- remove this abort-instruction
Jul 01 17:47:59 localhost.localdomain vector[11561]: │ │
Jul 01 17:47:59 localhost.localdomain vector[11561]: │ this function can't fail

[spencergilbert]

Without sharing the complete output I can't be sure, but I'd guess that message is suggesting that you remove the abort instruction (!) from the function.