# Issue in parsing the data in logstash
**URL:** https://discuss.elastic.co/t/issue-in-parsing-the-data-in-logstash/89411
**Category:** Logstash
**Created:** [June 14, 2017, 3:34pm UTC](https://discuss.elastic.co/t/issue-in-parsing-the-data-in-logstash/89411 "2017-06-14T15:34:39Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@viki](https://discuss.elastic.co/u/viki)
#### Post date: [June 14, 2017, 3:34pm UTC](https://discuss.elastic.co/t/issue-in-parsing-the-data-in-logstash/89411/1 "2017-06-14T15:34:40Z")
Hi,
Facing parsing error with spaces,
Input :
2017-06-13 04:02:18,933 INFO [SIRAHULOG] (http-10.80.6.102-16013-25) Thread ID:221:AppSessionFilter:doPost:user session:Everything matched
We are grep "INFO" (it has two spaces between "INFO" and "[SIRAHULOG]" ) using below
grok {
match =\> {"message" =\> [
"^%{TIMESTAMP\_ISO8601:time} %{LOGLEVEL:loglevel} [%{DATA:class}] %{GREEDYDATA:message}" ]
}
Output :
.
.
"loglevel" =\> "INFO",
.
.
But other than INFO like ERROR or FATAL logs we have only one space left between "ERROR" and "[SIRAHULOG]" . So , parsing fails
Example input :
2017-06-14 03:46:09,132 FATAL [SIRAHULOG] (WorkManager(2)-33) Thread ID:147:Error getting Entity Manager for firm 105471 Name : persistence-units/apptivodb3: firm id: 105471
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2017, 6:04am UTC](https://discuss.elastic.co/t/issue-in-parsing-the-data-in-logstash/89411/2 "2017-06-15T06:04:25Z")
Adjust your expression to allow for one or more spaces between the tokens:
```
^%{TIMESTAMP_ISO8601:time} +%{LOGLEVEL:loglevel} +[%{DATA:class}] +%{GREEDYDATA:message}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2017, 6:04am UTC](https://discuss.elastic.co/t/issue-in-parsing-the-data-in-logstash/89411/3 "2017-07-13T06:04:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.