# How to strip white space from all fields in logstash

**URL:** <https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255>\
**Category:** Logstash\
**Created:** [May 15, 2019, 6:27pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255 "2019-05-15T18:27:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rahulkothanath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahulkothanath/32/99122_2.png) [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Post date:** [May 15, 2019, 6:27pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/1 "2019-05-15T18:27:33Z")

</div>

I am creating fields using grok match with position and resulting json fields contain white spaces.

I need to trim the white space from all fields .

```
input { stdin { } }

filter {
  grok {
   
       match => { "message" => "(?<COMP_VER_NO>^.{6})(?<f1>.{2})(?<f2>.{20})(?<FILLER_CM>.{8})(?<f3>.{1})(?<f4>.{1})(?<f5>.{18})(?<f6>.{1})(?<f7>.{20})(?<f8>.{3})(?<f9>.{3})(?<f10>.{8})(?<a1>.{6})(?<CRD_FI_ID>.{5})(?<f1>.{19})(?<a2>.{2})(?<CLIENT_NM>.{30})(?<a3>.{3})(?<a4>.{5})(?<a5>.{8})(?<a6>.{5})(?<aa7>.{1})(?<a8>.{8})(?<a9>.{8})" }

}

#I want to trim all fields created by above grok

}

output {

  stdout { codec => rubydebug }
}

```

how can I trim all the fields in resulting json ?

thanks for reading and helping.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [May 15, 2019, 7:18pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/2 "2019-05-15T19:18:31Z")

</div>

Check this might help

[https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/7](https://discuss.elastic.co/t/how-to-trim-zero-or-more-leading-and-trailing-spaces-from-key-value-pairs/117933/7)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 15, 2019, 7:33pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/3 "2019-05-15T19:33:56Z")

</div>

> [@rahulkothanath](#):
>
> how can I trim all the fields in result

You have two fields called f1 which results in f1 being an array. I renamed the second one to be f11. Then this works:

```
    ruby {
        code => '
            event.to_hash.each { | k, v|
                if v.is_a? String
                    event.set(k, v.strip)
                end
            }
        '
    }

```

@elasticforme the technique used in the post you linked to does not work because it relies on removing spaces around field delimiting characters. Rahul's data is not delimited, it is all fixed width -- see how every single grok field has a fixed width set using {n}

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [May 15, 2019, 7:43pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/4 "2019-05-15T19:43:31Z")

</div>

> [@Badger](#):
>
> ruby { code =\> ' event.to\_hash.each { | k, v| if v.is\_a? String event.set(k, v.strip) end } ' }

I am trying to understand this. is it saying

event.to\_hash.each {|k, v| -\> get each key-value pair  
if v.is\_a? string -\> if value is a string then  
event.set(k, v.strip) -\> set key as is, and strip space from value

is this correct assumption?

---

<div class="post-metadata">

**Author:** ![rahulkothanath](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rahulkothanath/32/99122_2.png) [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Post date:** [May 15, 2019, 7:47pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/5 "2019-05-15T19:47:59Z")

</div>

I dont have any delimiter as badger informed. I can only use position based regex to match my fields within grok pattern

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 15, 2019, 8:51pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/6 "2019-05-15T20:51:26Z")

</div>

> [@elasticforme](#):
>
> is this correct assumption?

Yes, you are reading it correctly. It strips leading and trailing (but not embedded) spaces from the value.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2019, 8:51pm UTC](https://discuss.elastic.co/t/how-to-strip-white-space-from-all-fields-in-logstash/181255/7 "2019-06-12T20:51:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.