# Logstash Parsing Error for Field which contains Spaces

**URL:** <https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083>\
**Category:** Logstash\
**Created:** [August 3, 2016, 9:19am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083 "2016-08-03T09:19:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rathna](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rathna](https://discuss.elastic.co/u/rathna)\
**Post date:** [August 3, 2016, 9:19am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/1 "2016-08-03T09:19:38Z")

</div>

Hi

I am trying to parse the below log line by mutating the pipe symbol with space. However some time there are few field value contains some spaces in between(The last field in the example given below) and after parsing that field value is considered as three different fields (i.e.. access, token, expired). How can i solve this issue?

API-PROXY-1|1469599856616|1469599856625|rrt-6e3138e4-eu-15765-5137040-1|123.12.123.123|test-api|Access Token expired|

Logstash Conf:

mutate{  
gsub =\> ["message", "|", " "]  
}

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 3, 2016, 9:41am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/2 "2016-08-03T09:41:03Z")

</div>

Have you tried using the [csv filter plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-csv.html) with `'|'` specified as`separator`?

---

<div class="post-metadata">

**Author:** ![rathna](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rathna](https://discuss.elastic.co/u/rathna)\
**Post date:** [August 4, 2016, 6:42am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/3 "2016-08-04T06:42:10Z")

</div>

CSV filter plugin would look for a column to do this, in my case the logs are in plain log format. Would I be able to use CSV filter plugin at all?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 4, 2016, 8:12am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/4 "2016-08-04T08:12:20Z")

</div>

The csv filter parses the line based on a configurable separator, in your case '|' rather than ',' which is normally used for csv files. It should work on the data you provided as an example.

---

<div class="post-metadata">

**Author:** ![rathna](https://avatars.discourse-cdn.com/v4/letter/r/f14d63/32.png) [@rathna](https://discuss.elastic.co/u/rathna)\
**Post date:** [August 8, 2016, 4:53am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/5 "2016-08-08T04:53:23Z")

</div>

Thanks. Its working now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083/6 "2017-07-06T04:44:23Z")

</div>