# Help with Grok pattern with space in field?

**URL:** https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695
**Category:** Logstash
**Created:** [December 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695 "2021-12-13T17:07:02Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 13, 2021, 6:09pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695/2 "2021-12-13T18:09:50Z")

</div>

> [@vladislav](#):
>
> query: [s03.amazon.com](http://s03.amazon.com) IN A + (21.12.21.21)  
> query: [s2.tabtest.com](http://s2.tabtest.com) IN AAAA +++ (213.12.21.21)  
> query: [t4.asaptest.com](http://t4.asaptest.com) OUT TD OP- (21.124.21.21)

Is that three separate log lines, or have you already combined them into one event? grok will only match a pattern once. If the pattern is repeated it will not return multiple matches. You can use a ruby filter to do that. [Here](https://discuss.elastic.co/t/nested-repeating-group/213638/2) is an example.

---

_[View the full topic](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/291695)._