# How to create filter to handle spaces & commas in street addresses & person names?

**URL:** <https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604>\
**Category:** Logstash\
**Created:** [April 6, 2020, 1:29am UTC](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604 "2020-04-06T01:29:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hc-jgregory](https://avatars.discourse-cdn.com/v4/letter/h/d2c977/32.png) [@hc-jgregory](https://discuss.elastic.co/u/hc-jgregory)\
**Post date:** [April 6, 2020, 1:29am UTC](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604/1 "2020-04-06T01:29:39Z")

</div>

Sample text from log (comes in a segment without quotes enclosing field and values as expected if true JSON):

_{Field1=1111 NE 1ST AVE,Field2=ATLANTA, GA 30309-1111,Field3=JOHN ALLEN DOE}_

```auto
        filter {
            grok {
                    match => { "message" => "%{TIMESTAMP_ISO8601:log_timestamp}%{SPACE}%{GREEDYDATA:log_header}\{%{GREEDYDATA:json_detail}\}%{GREEDYDATA:log_footer}" }
            }
            date {
                    match => ["log_timestamp","yyyy-MM-dd HH:mm:ss"]
            }
            kv {
                    source => "json_detail"
                    trim_key => "<>\[\]\{\},"
                    trim_value => "<>\[\]\{\},"
                    allow_duplicate_values => false
            }
            mutate {
                    remove_field => ["message","log_timestamp","log_header","log_footer"]
            }
    }

```

Thanks!

Jason

---

<div class="post-metadata">

**Author:** ![Robo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robo/32/38295_2.png) [@Robo](https://discuss.elastic.co/u/Robo)\
**Post date:** [April 6, 2020, 6:33am UTC](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604/2 "2020-04-06T06:33:46Z")

</div>

If the json\_detail has always the same format, maybe you can use dissect filter here:

```auto
filter {
    dissect {
      mapping => {
        #separated fields
        "message" => "Field1=%{address},Field2=%{city},Field3=%{name}"
        #one field
        "message" => "Field1=%{contact},Field2=%{+contact},Field3=%{+contact}"
      }
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2020, 6:33am UTC](https://discuss.elastic.co/t/how-to-create-filter-to-handle-spaces-commas-in-street-addresses-person-names/226604/3 "2020-05-04T06:33:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.