# Grok pattern to get the whole text without considering space
**URL:** https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095
**Category:** Logstash
**Created:** [June 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095 "2020-06-22T13:39:17Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095/1 "2020-06-22T13:39:18Z")
I am trying to grok a message text with my grok pattern if i pass the sample data without space my grok pattern works fine but if there is any space in between text it fetch only the first word before space and after space it ignores.
In my case i need to get the whole text with out considering space. I have given my grok pattern and sample data below.
**Sample data**
```auto
"CSIC_agentId:bo peng"
```
**Grok pattern**
```auto
CSIC_agentId:%{NOTSPACE:apm_agentId.agentId}
```
**Result**
```auto
{
"apm_agentId": {
"agentId": "bo"
}
}
```
**Expected result:**
```auto
{
"apm_agentId": {
"agentId": "bo peng"
}
}
```
Could some one help me to resolve this issue.? Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 22, 2020, 11:06pm UTC](https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095/2 "2020-06-22T23:06:21Z")
It should be no surprise that NOTSPACE stops matching when it reaches a space.
If your sample data really is
```
"CSIC_agentId:bo peng"
```
then you could match the field against
```
'"CSIC_agentId:%{DATA:apm_agentId.agentId}"'
```
---
### Author:  [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)
#### Post date: [June 23, 2020, 6:55am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095/3 "2020-06-23T06:55:15Z")
Hi @Badger
If i use the above grok pattern in my grok debugger it is working fine.
use the same in my pipeline it is not working as expected.
**Pipeline**
```auto
PUT _ingest/pipeline/dissectpipeline
{
"description" : "split message content",
"processors" : [
{
"grok" : {
"field" : "message",
"patterns" : [
"CSIC_agentId:%{DATA:apm_agentId.agentId}"
]
}
}
]
}
```
**pipeline simulation**
It returns empty
```auto
POST /_ingest/pipeline/dissectpipeline/_simulate
{
"docs": [
{
"_index": "index",
"_id": "id",
"_source": {
"message": "CSIC_agentId:agent003"
}
},
{
"_index": "index",
"_id": "id",
"_source": {
"message": "CSIC_agentId:agent004"
}
}
]
}
```
I want you to look into this it's seems to be strange working in grok debugger not in pipeline.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 21, 2020, 6:55am UTC](https://discuss.elastic.co/t/grok-pattern-to-get-the-whole-text-without-considering-space/238095/4 "2020-07-21T06:55:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.