# Grok filter - space not working
**URL:** https://discuss.elastic.co/t/grok-filter-space-not-working/80141
**Category:** Logstash
**Created:** [March 27, 2017, 1:52pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141 "2017-03-27T13:52:25Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@August\_rush](https://discuss.elastic.co/u/August_rush)
#### Post date: [March 27, 2017, 1:52pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/1 "2017-03-27T13:52:25Z")
Hi , I am trying to use grok filter on this log , There is a space after WARN I have tried using %s\* \s\* and also %{SPACE} but it is not triggering an email. can some one please help me.
[2017-03-25T00:00:07,137][WARN]
```
input {
file {
path => "/var/log/logstash/sample"
start_position => beginning
}
}
filter {
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{LOGLEVEL:log-level}\s*\]" }
}
}
output {
email {
port => 25
address => "mail.tck.com"
authentication => "login"
use_tls => true
from => "alerts@logstash.com"
subject => "logstash alert"
to => "abc@tck.com"
via => "smtp"
body => "%{message}"
debug => true
}
}
~
```
~
I am using log stash 2.2.4
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 2:33pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/2 "2017-03-27T14:33:39Z")
Your grok filter doesn't affect whether an email is sent or not. If you're not getting an email that could be because
- Logstash isn't reading any lines from the file,
- the email output isn't working,
- the email is getting held up somewhere outside of Logstash.
---
### Author:  [@August\_rush](https://discuss.elastic.co/u/August_rush)
#### Post date: [March 27, 2017, 2:37pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/3 "2017-03-27T14:37:57Z")
I tried to change the log file (without space after WARN) and it worked by sending an email.
[2017-03-25T00:00:07,137][WARN]
`match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\]\[%{LOGLEVEL:log-level}\]" }`
```
so thus, i think there is something wrong with my filter.
Does grok filter (\s*) work only for logstash versions 2.4 and above , i am using 2.2.4
```
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [March 27, 2017, 2:41pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/4 "2017-03-27T14:41:07Z")
> Does grok filter (\s\*) work only for logstash versions 2.4 and above , i am using 2.2.4
No, that's standard regexp notation that works on any version of Logstash.
---
### Author:  [@August\_rush](https://discuss.elastic.co/u/August_rush)
#### Post date: [March 27, 2017, 5:28pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/5 "2017-03-27T17:28:06Z")
Thanks Magnus, yes it was some issue with the mail server.
Now its working.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 24, 2017, 5:28pm UTC](https://discuss.elastic.co/t/grok-filter-space-not-working/80141/6 "2017-04-24T17:28:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.