# Help with Grok pattern with space in field?
**URL:** https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695
**Category:** Logstash
**Created:** [December 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695 "2021-12-13T17:07:02Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vladislav](https://discuss.elastic.co/u/vladislav)
#### Post date: [December 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/1 "2021-12-13T17:07:02Z")
I have the following logs looks like:
query: [s03.amazon.com](http://s03.amazon.com) IN A + (21.12.21.21)
query: [s2.tabtest.com](http://s2.tabtest.com) IN AAAA +++ (213.12.21.21)
query: [t4.asaptest.com](http://t4.asaptest.com) OUT TD OP- (21.124.21.21)
I need output to look like this:
hostname [[s03.amazon.com](http://s03.amazon.com), [s2.tabtest.com](http://s2.tabtest.com), [t4.asaptest.com](http://t4.asaptest.com)]
level [A +, AAAA +++, TD OP-]
ip [21.12.21.21, 213.12.21.21, 21.124.21.21]
I have problems with "level" string, because it contains a space between data. How to write a working grok parser for that? Big thanks for any help.
I've tried something like:
query: %{NOTSPACE:hostname} IN %{NOTSPACE:level}+ %{NOTSPACE:level} %{GREEDYDATA:ip}
but it not works as I mentioned above.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 13, 2021, 6:09pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/2 "2021-12-13T18:09:50Z")
> [@vladislav](#):
>
> query: [s03.amazon.com](http://s03.amazon.com) IN A + (21.12.21.21)
> query: [s2.tabtest.com](http://s2.tabtest.com) IN AAAA +++ (213.12.21.21)
> query: [t4.asaptest.com](http://t4.asaptest.com) OUT TD OP- (21.124.21.21)
Is that three separate log lines, or have you already combined them into one event? grok will only match a pattern once. If the pattern is repeated it will not return multiple matches. You can use a ruby filter to do that. [Here](https://discuss.elastic.co/t/nested-repeating-group/213638/2) is an example.
---
### Author:  [@vladislav](https://discuss.elastic.co/u/vladislav)
#### Post date: [December 13, 2021, 8:59pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/3 "2021-12-13T20:59:24Z")
There are three separate logs, I added them just to show how it's look like, I know that grok will only match once.
My question is - how to add something like"AAA ++" (with space(s) between data) in one field, and additional task, how to grab ip from '()'
Thanks in advance!
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 13, 2021, 9:13pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/4 "2021-12-13T21:13:22Z")
If your messages have always this format, you do not need grok, you can parse it with dissect.
The following dissect filter parses this message format:
```auto
dissect {
mapping => {
"message" => "query: %{hostname} %{} %{level} (%{ip})"
}
}
```
So, considering the examples you shared, you will have as output:
```auto
{
"message" => "query: t4.asaptest.com OUT TD OP- (21.124.21.21)",
"@version" => "1",
"hostname" => "t4.asaptest.com",
"level" => "TD OP-",
"@timestamp" => 2021-12-13T21:10:15.846Z,
"host" => "logstash",
"ip" => "21.124.21.21"
}
{
"message" => "query: s03.amazon.com IN A + (21.12.21.21)",
"@version" => "1",
"hostname" => "s03.amazon.com",
"level" => "A +",
"@timestamp" => 2021-12-13T21:10:15.834Z,
"host" => "logstash",
"ip" => "21.12.21.21"
}
{
"message" => "query: s2.tabtest.com IN AAAA +++ (213.12.21.21)",
"@version" => "1",
"hostname" => "s2.tabtest.com",
"level" => "AAAA +++",
"@timestamp" => 2021-12-13T21:10:15.846Z,
"host" => "logstash",
"ip" => "213.12.21.21"
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 13, 2021, 9:24pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/5 "2021-12-13T21:24:57Z")
I agree that dissect is a better tool for this use case, but to answer the original question
```
grok { match => { "message" => "query: %{HOSTNAME:hostName} %{DATA:someField} \(%{IPV4:ip}\)" } }
```
would produce events like
```
"someField" => "OUT TD OP-",
"ip" => "21.124.21.21",
"hostName" => "t4.asaptest.com",
```
---
### Author:  [@vladislav](https://discuss.elastic.co/u/vladislav)
#### Post date: [December 14, 2021, 1:03pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/6 "2021-12-14T13:03:56Z")
Thanks @leandrojmp @Badger very much! Everything works fine, tried like @Badger posts with micro-reconfiguring:
query: %{HOSTNAME:hostName} IN %{DATA:level} (%{IPV4:ip})
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 11, 2022, 1:04pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/7 "2022-01-11T13:04:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.