# How to filter Data with Spaces in Logstash **URL:** \ **Category:** Logstash\ **Created:** [March 5, 2019, 3:13pm UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939 "2019-03-05T15:13:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 5, 2019, 3:13pm UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/1 "2019-03-05T15:13:36Z")
Hello Folks, i need some Help here to read this Example Data in my Text editor with its Spaces in Logstash. Example Data in my Text editor as follows: ``` Hello World Hello back ``` Please notice the Spaces between the worlds and the Spaces between the Start in each row, and the empty Line between those two Sentences. How can i let Logstash read this Example . i tried with follows , but i could not let Logstash jump to a new Line with Space at the Beginning. input{{ ...}} filter{ grok { match =\> { "message" =\> "%{SPACE}%{WORD:hello}%{SPACE}%{WORD:world}(?[\r\n]+)%{SPACE}{WORD:hi}%{SPACE}%{WORD:you}"} }} output{{.....}} Can anybody help me please to correct my filter ? thx. ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 5, 2019, 4:00pm UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/2 "2019-03-05T16:00:47Z")
> [@samyo](#): > > Hello World HI samyo, Can you try with this pattern, \s%{WORD:data1}\s+%{WORD:data2} ---
**Author:** ![Daniel37](https://avatars.discourse-cdn.com/v4/letter/d/fbc32d/32.png) [@Daniel37](https://discuss.elastic.co/u/Daniel37)\ **Post date:** [March 6, 2019, 7:36am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/3 "2019-03-06T07:36:34Z")
> [@Ganesh2303](#): > > > [@samyo](#): > > > > Hello World > > HI samyo, > Can you try with this pattern, [vidmate](https://www.vidmate.software/) > > \s%{WORD:data1}\s+%{WORD:data2} Please let me know if you need any further info. ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 8:30am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/4 "2019-03-06T08:30:46Z")
Hi Daniel37 and Ganesh2303: i tried this \s%{WORD:data1}\s+%{WORD:data2} and it did not work correctly . i tried this \s+%{WORD:data1}\s+%{WORD:data2} it works for this follows example: ``` Hello World ``` i noticed that \s+%{WORD:data1}\s+%{WORD:data2} can read the first empty line in my text editor and than some whiteSpaces until the "Hello" and the second \s+ let me just add one whitespace between each other word nothing else. it does not allowed me to jump to next empty Line , or to read the Example above . i need to read the Example above correctly with all whitespaces , and all empty Lines. Can you please help me , i even tried with this match =\> { "message" =\> "\s+%{WORD:data1}\s+\r%{WORD:data2}"} in order to try to jump to next empty Line. i tried this too match =\> { "message" =\> "\s+%{WORD:data1}\s+\n%{WORD:data2}"} Nothing works until now. ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 8:33am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/5 "2019-03-06T08:33:41Z")
Hi Ganesh2303: i tried your \s%{WORD:data1}\s+%{WORD:data2} and it did not work correctly. it could not read empty Line or jump into after empty Line with Whitespaces. with this: \s+%{WORD:data1}\s+%{WORD:data2} i could read just Hello World ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 9:39am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/6 "2019-03-06T09:39:23Z")
> [@samyo](#): > > Hello World Yeah this is your message so it will retrieve the data without those whitespaces right ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 9:40am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/7 "2019-03-06T09:40:56Z")
i need to let logstash jump after the empty Line and get the rest of my above example "Hello back" . as soon as Logstash see an empty Line after "Hello World" , it will return nothing after that. That is the Issue. Do you have any suggestion? ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 9:44am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/8 "2019-03-06T09:44:56Z")
So you are saying that 2 line are single message am i right ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 9:49am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/9 "2019-03-06T09:49:04Z")
i did not understand correctly what you meant with "2 Lines are single message" ? i need to let Logstash read my "Hello back", that means after reading the "Hello World" , it has to jump after any empty Line he sees and get the Rest "Hello Back". ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 9:49am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/10 "2019-03-06T09:49:37Z")
Ok, Can you try this and let me know, \s%{WORD:data1}\s+%{WORD:data2}\n\s+%{WORD:data3}\s%{WORD:data4} ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 9:50am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/11 "2019-03-06T09:50:57Z")
> [@samyo](#): > > i did not understand correctly what you meant with "2 Lines are single message" ? Logstash is line to line read process, if your message is single line no issues but if you want to process 1 or 2 line message we need to configure according to that message. ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 9:55am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/12 "2019-03-06T09:55:03Z")
it did not work , the "\n" did not help to jump after an empty Line. ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 10:06am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/14 "2019-03-06T10:06:19Z")
As per my understand, hello world is one line, empty space is one line, hello back is one line am i right ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 10:10am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/15 "2019-03-06T10:10:12Z")
![example](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54ea0d726a6aeaf3e9c2132fbfcab52e374eb30f.jpeg) ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 10:15am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/16 "2019-03-06T10:15:18Z")
![example%202](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e1aa5beb47e14004761cdd5394caf9c33ce5f91.jpeg) ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 10:28am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/17 "2019-03-06T10:28:12Z")
Try with drop command if the line is empty those line need to skip ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 10:31am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/18 "2019-03-06T10:31:35Z")
that is my Filter , an it does not work, i tried to use drop comand too. filter { grok {match =\> { "message" =\> "\s%{WORD:data1}\s+%{WORD:data2}\n\s+%{WORD:data3}\s%{WORD:data4}"} } if [message] =~ /^\s\*$/ { drop { } } } ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 6, 2019, 10:32am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/19 "2019-03-06T10:32:49Z")
Sorry for Late answer, cause this tool here blocked me for 20 Hour cause of reaching my maximum text level. so i am just able to modify my old Comments in order to ask for help. i tried to put drop Command like follows, but still could not read the Example above correctly, any Suggestions. filter { if [message] =~ /^\s\*$/ { drop { } } grok {match =\> { "message" =\> "\s%{WORD:data1}\s+%{WORD:data2}\n\s+%{WORD:data3}\s%{WORD:data4}"} } } ---
**Author:** ![Ganesh2303](https://avatars.discourse-cdn.com/v4/letter/g/57b2e6/32.png) [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Post date:** [March 6, 2019, 10:35am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/20 "2019-03-06T10:35:18Z")
> [@samyo](#): > > filter { > > grok {match =\> { "message" =\> "\s%{WORD:data1}\s+%{WORD:data2}\n\s+%{WORD:data3}\s%{WORD:data4}"} > } > if [message] =~ /^\s\*$/ { > drop { } > } > } Use your drop filter first and then use filter condition, because intially your filter works first and then only it will goes for drop condition as per your configuration. ---
**Author:** ![samyo](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@samyo](https://discuss.elastic.co/u/samyo)\ **Post date:** [March 7, 2019, 8:09am UTC](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939/21 "2019-03-07T08:09:33Z")
Hello Ganesh33, sorry for late Response, so i did do what you said about drop Command at Beginning of my filter, filter { if [message] =~ /^\s\*$/ { drop { } } grok {match =\> { "message" =\> "\s%{WORD:data1}\s+%{WORD:data2}\n\s+%{WORD:data3}\s%{WORD:data4}"} } } it is still does not work to tell Logstash to jump over an empty Line , and jump the whitespaces until reach the "Hello Back" sentence and read it. as you can see in the above Picture. the "\n\s" did not do anything to let Logstash reach the "Hello Back" sentence. Any Suggestion? [Next page](https://discuss.elastic.co/t/how-to-filter-data-with-spaces-in-logstash/170939.md?page=2)