# Grok custom pattern for space delimited file

**URL:** https://discuss.elastic.co/t/grok-custom-pattern-for-space-delimited-file/238291
**Category:** Logstash
**Created:** [June 23, 2020, 3:27pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-for-space-delimited-file/238291 "2020-06-23T15:27:28Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![atchyuth](https://avatars.discourse-cdn.com/v4/letter/a/94ad74/32.png) [@atchyuth](https://discuss.elastic.co/u/atchyuth)
#### Post date: [June 23, 2020, 3:27pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-for-space-delimited-file/238291/1 "2020-06-23T15:27:28Z")

</div>

I'm trying to load a file to structured table in Athena. I am using GROK pattern to load it to the table but not able to find the correct pattern. The file format is as below:

L1127 ACTUALS 214171 ON 27649075 -00000000000000000409618.02 601 MBS DAILY VISION - CAN OS

L1127 ACTUALS 412821 ON 27649075 002060 -00000000000000000002657.33 521 MBS DAILY VISION - CAN OS

GROK pattern I'm using : (?.{5})%{SPACE}(?.{7})%{SPACE}(?.{6})%{SPACE}(?.{2})%{SPACE}(?.{8})%{SPACE}(?.{6})%{SPACE}(?.{27})%{SPACE}(?.{3})%{SPACE}(?.{35})

I'm having trouble when the ProductId has no value.

Any help would be appreciated

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 23, 2020, 5:23pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-for-space-delimited-file/238291/2 "2020-06-23T17:23:15Z")

</div>

You cannot use . everywhere since that will always match. If you use NOTSPACE for the fields and make the sixth field (and preceding space) optional by appending ? to the pattern then it will work.

```
grok { match => { "message" => "^(?<a>[^]{5})%{SPACE}(?<b>[^]{7})%{SPACE}(?<c>[^]{6})%{SPACE}(?<d>[^]{2})%{SPACE}(?<e>[^]{8})%{SPACE}?(?<f>[^]{6})?%{SPACE}(?<g>[^]{27})%{SPACE}(?<h>.{3})%{SPACE}(?<i>.+)" } }

```

Also, you do not have 35 characters at the end, so change the {35} to +

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2020, 5:23pm UTC](https://discuss.elastic.co/t/grok-custom-pattern-for-space-delimited-file/238291/3 "2020-07-21T17:23:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.