It is an example to show you a bug... I need to replace '\n' with '\n\t—>\t' so I can use filebeat multiline to join different line of same log message together before send them to a remote system and also keep them readable on stdout The bug is that any escaped char (eg: \n or \t ) is re-escaped after substitution |