# Grok pattern for space OR double space

**URL:** <https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725>\
**Category:** Logstash\
**Created:** [May 15, 2017, 8:53am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725 "2017-05-15T08:53:17Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 8:53am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/1 "2017-05-15T08:53:17Z")

</div>

Hi,  
I have logs like that ,  
`Wed May 10 02:50:43 2017`  
`Wed May 3 12:23:21 2017`  
My grok pattern works when they are only 1 space , like the "Wed May 10 02:50:43 2017" but with "Wed May 3 12:23:21 2017", it doesn't work. But when i remove one space, it's operate.

My grok pattern is :  
`SAPROUTER_DATESTAMP (%{SAPROUTER_DAY}%{SAPROUTER_MONTH}%{SAPROUTER_MONTHDAY}%{SAPROUTER_TIME}%{SAPROUTER_YEAR})`  
Thank you

When I change my grok pattern with a space like that , it works with the 3 may but not with the 10  
`{SAPROUTER_MONTH} %{SAPROUTER_MONTHDAY}`

PS: I already try '+' and '{1,2}

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 15, 2017, 9:18am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/2 "2017-05-15T09:18:43Z")

</div>

The problem for you might come from your definition of SAPROUTER\_MONTH or SAPROUTER\_MONTHDAY which already includes one space. That's why `+`didn't work (+ means at least one occurence) and the same goes for {1,2}

So `\s*` might work, as well as `\s{0,1}` which is equal to `\s?`.  
A space in your definition really defines a space so be carefull with that and do not input extra spaces when not needed

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 15, 2017, 9:19am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/3 "2017-05-15T09:19:09Z")

</div>

But... `Wed May 3 12:23:21 2017` doesn't have any double spaces. The problem appears to be with your SAPROUTER\_MONTHDAY pattern.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 9:20am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/4 "2017-05-15T09:20:25Z")

</div>

He had, I fail CC but he had double space 🙂

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 9:23am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/5 "2017-05-15T09:23:16Z")

</div>

> [@Nico-DF](#):
>
> \s{0,1}

Thank you, it works 🙂

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 15, 2017, 9:25am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/6 "2017-05-15T09:25:13Z")

</div>

By the way, you might want to clean you pattern not to match extra space. Always tests your patterns beforehand to avoid any errors like this.  
([http://grokdebug.herokuapp.com/](http://grokdebug.herokuapp.com/))

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 9:28am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/7 "2017-05-15T09:28:40Z")

</div>

Yes I already try but It doesn't take into account the space (my pattern worked on this site) 😕

---

<div class="post-metadata">

**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\
**Post date:** [May 15, 2017, 9:30am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/8 "2017-05-15T09:30:34Z")

</div>

Correctly works for me. Maybe just like here, double space wasn't properly add, or forgotten a space in your pattern, etc.

Anyway, pay attention to this.

---

<div class="post-metadata">

**Author:** ![Saplog](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Saplog](https://discuss.elastic.co/u/Saplog)\
**Post date:** [May 15, 2017, 9:33am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/9 "2017-05-15T09:33:53Z")

</div>

Yes maybe,  
Thanks again !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 9:42am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725/10 "2017-06-12T09:42:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.