Grok filter if value is void

Elastic Stack Logstash
1

Hello Guys,
I have Logstash-2.2.2-1 and I have a filter in grok to add fields, for example:

Input:

"2016-04-01 00:00:00" "value1" "value2" 100

Grok:

%{TIMESTAMP_ISO8601:EventTime} %{WORD:value1} %{WORD:value1} %{NUMBER:number1}

But sometimes value 1 or value 2 is void, for example:

input:

"2016-04-01 00:00:00" "" "value2" 100

Can I filter when the value is void?, because the filter doesn't work if the value is void

Thank you.

2

Try with %{NOTSPACE} instead.

3

Its works, thank you!!
But what is NOTSPACE?.

Thank you.

4

I answer myself is \S+ .

Thank you.