# Filter multiple spaces with a single Dissect field?

**URL:** <https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114>\
**Category:** Logstash\
**Created:** [January 21, 2019, 7:55pm UTC](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114 "2019-01-21T19:55:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\
**Post date:** [January 21, 2019, 7:55pm UTC](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114/1 "2019-01-21T19:55:07Z")

</div>

Hello, I am trying to extract the message part of the event below which starts at "Not able to... " without having to use multiple %{+error\_message} fields but only a single field. Is that possible?

17.01.2019 17:16:23.175 _WARN_ [10.43.32.119 [1547745383173] GET /content/regent.html HTTP/1.1] com.adobe.fd.core.security.internal.CurrentUserServiceImpl Not able to find user for userId [anonymous]

my LS config file looks like this and it works but trying to be more efficient with less lines in my code.

input {  
file {  
path =\> "/root/logstash/aemlog"  
sincedb\_path =\> "/dev/null"  
start\_position =\> "beginning"  
}  
}

filter {  
dissect {  
mapping =\> {  
"message" =\> "%{syslog\_timestamp} %{+syslog\_timestamp} %{severity} [%{ip} %{?skip1} %{method} %{file} %{version}] %{?skip2} %{error\_message} %{+error\_message} %{+error\_message} %{+error\_message} %{+error\_message} %{+error\_message} %{+error\_message} [%{username}] "  
}  
}  
}

The output looks like:  
"error\_message" =\> "Not able to find user for userId",  
"severity" =\> "_WARN_",  
"method" =\> "GET",  
"ip" =\> "10.43.32.13",  
"version" =\> "HTTP/1.1",  
"file" =\> "/content/regent.html",  
"syslog\_timestamp" =\> "17.01.2019 17:16:13.135",  
"username" =\> "anonymous]"

Thank you

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 21, 2019, 8:52pm UTC](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114/2 "2019-01-21T20:52:33Z")

</div>

As you have a space followed by a square bracket at the end of the error message I think you can simplify it:

```auto
input {
  generator {
    lines => ['17.01.2019 17:16:23.175 WARN [10.43.32.119 [1547745383173] GET /content/regent.html HTTP/1.1] com.adobe.fd.core.security.internal.CurrentUserServiceImpl Not able to find user for userId [anonymous]']
    count => 1
  } 
} 

filter {
  dissect {
    mapping => {
      "message" => "%{syslog_timestamp} %{+syslog_timestamp} %{severity} [%{ip} %{} %{method} %{file} %{version}] %{} %{error_message} [%{username}]%{}"
    }
  }
}

output {
  stdout { codec => rubydebug }
}

```

---

<div class="post-metadata">

**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\
**Post date:** [January 21, 2019, 10:40pm UTC](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114/3 "2019-01-21T22:40:35Z")

</div>

Thanks Christian! that really worked, below is my output with only one dissect field for the error\_message. Definitely more efficient. Thank you!

"severity" =\> "_WARN_",  
"error\_message" =\> "Not able to find user for userId",  
"method" =\> "GET",  
"ip" =\> "10.43.32.13",  
"syslog\_timestamp" =\> "17.01.2019 17:16:13.135",  
"@version" =\> "1",  
"username" =\> "anonymous"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 18, 2019, 10:40pm UTC](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114/4 "2019-02-18T22:40:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.