# Logstash grok filter ignoring white space delimiter

**URL:** <https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568>\
**Category:** Logstash\
**Created:** [January 24, 2017, 5:44am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568 "2017-01-24T05:44:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [January 24, 2017, 5:44am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568/1 "2017-01-24T05:44:21Z")

</div>

Hi,

I am using Logstash GA 5.0.0 with Kafka. I am ading a custom parameter `"logtype":"mylogs"` in kafka input. I have a Kafka message like;

```
##SEVERE 05-Jan-2017 06:02:25.562 com.memberA.studentB.classCa startup CUSTOM_FOUR::printf():::AA##

```

and in Logstash grok, i use filter like;

```
match => { "message" => "^##(?<severity>(SEVERE|INFO|WARN)) (?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME}) %{GREEDYDATA:className} %{GREEDYDATA:msg2}" }

```

but my Logstash output is like below;

```
{
	"severity":"SEVERE",
	"logtype":"mylogs",
	"msg2":"CUSTOM_FOUR::printf():::AA##",
	"@timestamp":"2017-01-24T05:32:30.226Z",
	"@version":"1",
	"className":"com.memberA.studentB.classCa startup",
	"message":"##SEVERE 05-Jan-2017 06:02:25.562 com.memberA.studentB.classCa startup CUSTOM_FOUR::printf():::AA##",
	"timestamp":"05-Jan-2017 06:02:25.562"
}

```

The tag `className` is suppose to be like `com.memberA.studentB.classCa`, but it slike `com.memberA.studentB.classCa startup` now. The term `startup` is coming along with it. How can I fix this?

Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [January 24, 2017, 5:53am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568/2 "2017-01-24T05:53:26Z")

</div>

As you just want the className pattern to capture up until the first space, try replacing `GREEDYDATA:className` with `NOTSPACE:className`.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [January 24, 2017, 5:57am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568/3 "2017-01-24T05:57:50Z")

</div>

It works! Thank you so much @Christian_Dahlqvist 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2017, 5:57am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568/4 "2017-02-21T05:57:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.