# Eliminate excesive blanks or select fields for position

**URL:** <https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390>\
**Category:** Logstash\
**Created:** [May 21, 2025, 3:48pm UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390 "2025-05-21T15:48:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fernandosss](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@fernandosss](https://discuss.elastic.co/u/fernandosss)\
**Post date:** [May 21, 2025, 3:48pm UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390/1 "2025-05-21T15:48:12Z")

</div>

Hello,

I'd like it if someone could help me with the following problem.

I'm sending a series of logs to logstash/elastic.

The problem is that my logs are separated by blanks, and sometimes after the first field, there can be more than one blank. If I set separator =\> " ", many empty fields are created because I have many blanks in a row.  
I want to replace excessive blanks with a single blank.  
I would also like to select the fields by position since they always appear in the same position.  
I've attached a log sample.

Thanks

 ![Captura de pantalla 2025-05-21 173456](https://us1.discourse-cdn.com/elastic/original/3X/1/c/1cc4ac955ecf53fce1fedc0beb0b6e07ea3d64b5.jpeg)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 21, 2025, 4:22pm UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390/2 "2025-05-21T16:22:41Z")

</div>

You could use a `gsub` in the `mutate` filter to replace one or more blank space by just one blank space or a different separator.

Can you share a plain text sample of your messages so this can be tested?

---

<div class="post-metadata">

**Author:** ![fernandosss](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@fernandosss](https://discuss.elastic.co/u/fernandosss)\
**Post date:** [May 21, 2025, 4:54pm UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390/3 "2025-05-21T16:54:05Z")

</div>

Ok, thanks

```auto
EXW1.POTHYEW.APOTHYE.D250521.T112630.N01 000000011904 000049 LOYTHT 20250521 112654 VBLE 000496 000000000 POR.POTHYEW.R0049.APOTHYE.F250521.H1126.N01
EXW1.POTHYEW.APOTHYE.D250521.T112634.N01 000000011904 000049 OUJYHG 20250521 112654 VBLE 000496 000000000 POR.POTHYEW.R0049.APOTHYE.F250521.H1126.N02
FICF34.ENV 000000001040 000078 JUGHGF 20250521 134151 FIJO 000260 000000000 POR.POTHYEW.R0078.ATPVF34.F250521.H1342.N01
TL.SIHTP100.IUYRH43E.R008910.SKUKIV1 000000008720 000182 HSHHDU 20250521 010009 FIJO 000080 000000000 POR.POTHYEW.R0182.AOPYEV1.F250521.H0101.N01

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 21, 2025, 5:21pm UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390/4 "2025-05-21T17:21:39Z")

</div>

I can think of three ways to do this

```
    grok { match => { "message" => "^%{NOTSPACE:field1}\s+%{NOTSPACE:field2}\s+%{NOTSPACE:field3}\s+%{NOTSPACE:field4}\s+%{NOTSPACE:field5}\s+%{NOTSPACE:field6}\s+%{NOTSPACE:field7}\s+%{NOTSPACE:field8}\s+%{NOTSPACE:field9}\s+%{NOTSPACE:field10}" } }

```

or

```
    mutate { gsub => ["message", "\s+", " "] }
    csv { source => "message" separator => " " }

```

or

```
    mutate { gsub => ["message", "\s+", " "] }
    dissect { mapping => { "message" => "%{field1} %{field2} %{field3} %{field4} %{field5} %{field6} %{field7} %{field8} %{field9} %{field10}" } }

```

If you had fixed width fields with no spaces like

```auto
EXW1.POTHYEW.APOTHYE.D250521.T112634.N01 000000011904000049OUJYHG20250521112654VBLE000496000000000POR.POTHYEW.R0049.APOTHYE.F250521.H1126.N02
FICF34.ENV 000000001040000078JUGHGF20250521134151FIJO000260000000000POR.POTHYEW.R0078.ATPVF34.F250521.H1342.N01

```

You could use

```
grok { match => { "message" => "^(?<field1>.{44})(?<field2>.{12})(?<field3>.{6})(?<field4>.{6})(?<field5>.{8})(?<field6>.{6})(?<field7>.{4})(?<field8>.{6})(?<field9>.{9})(?<field10>.{42})" } }

```

---

<div class="post-metadata">

**Author:** ![fernandosss](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@fernandosss](https://discuss.elastic.co/u/fernandosss)\
**Post date:** [May 22, 2025, 7:23am UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390/5 "2025-05-22T07:23:00Z")

</div>

Great, thank you so much.  
I'll try it out.

Best regards