# Logstash filter if statement when detecting multiple whitespace in middle of string
**URL:** https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457
**Category:** Logstash
**Created:** [January 19, 2024, 3:52pm UTC](https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457 "2024-01-19T15:52:33Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mhoward](https://discuss.elastic.co/u/mhoward)
#### Post date: [January 19, 2024, 3:52pm UTC](https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457/1 "2024-01-19T15:52:33Z")
Hey all. I'm working on a Logstash pipeline that includes processing addresses.
Here's what my sample data might look like:
> " 123 ABC Street"
> "456 XYZ Street (a bunch of whitespaces here) PO Box 789"
The problem is if there's a PO Box I want that giant of whitespace to be taken out. I've already written a filter to accomplish this:
'''
> grok {
> match =\> [
> "address", "(%{DATA:address1} %{SPACE} %{DATA:address2})"
> ]
> }
> mutate {
> replace =\> { "address" =\> "%{address1} "%{address2}" }
> }
> }
> '''
> However, I want to add an if statement to these filters so that the filter only runs if a large white is detected in the middle of the string. I'm not finding much documentation on how to structure conditionals so any help would be appreciated.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 19, 2024, 6:46pm UTC](https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457/2 "2024-01-19T18:46:08Z")
How about
```
mutate { gsub => ["address", "\s+", " "] }
```
which will replace multiple whitespace characters with one space?
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [January 19, 2024, 7:45pm UTC](https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457/3 "2024-01-19T19:45:10Z")
Or you check does 2 or more space/tabs exist:
```auto
if ([address] =~ /[\s]{2,}/ ) {
grok {match => ["address", "(%{DATA:address1} %{SPACE} %{GREEDYDATA:address2})"] }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2024, 7:45pm UTC](https://discuss.elastic.co/t/logstash-filter-if-statement-when-detecting-multiple-whitespace-in-middle-of-string/351457/4 "2024-02-16T19:45:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.