# Parsing problem - one or more space
**URL:** https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285
**Category:** Logstash
**Created:** [November 3, 2019, 1:04pm UTC](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285 "2019-11-03T13:04:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Jan\_Kaspar](https://discuss.elastic.co/u/Jan_Kaspar)
#### Post date: [November 3, 2019, 1:04pm UTC](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285/1 "2019-11-03T13:04:25Z")
Hi All,
I would have a question about parsing the logs from DNS server logs.
Sample of DNS logs:
**message:** 3. 11. 2019 12:33:14 0958 PACKET 000000C97B8371C0 UDP Snd 192.168.5.202 4cbf Q [0000 NOERROR] SOA (4)mell(2)com(0)
**GROK:**
%{MS\_DNS\_DATE:date}\s+%{TIME:time}\s+%{DATA:thread\_id}\s+%{WORD:record\_type}\s+%{BASE16NUM:packet\_id}\s+%{WORD:dns\_protocol}\s+%{WORD:dns\_direction}\s+%{IP:dns\_ip}\s+%{BASE16NUM:xid}\s+%{DATA:response}\s+%{WORD:dns\_query\_type}\s+[%{BASE16NUM:hex\_flags}\s+%{WORD:rcode\_name}]\s+%{WORD:query\_type\_name}\s+%{GREEDYDATA:dns\_domain}
It was successfully parsed. I am using \s+ to catch one or more spaces. I dont undersand why following message is parsed wrong.
1.
1. 2019 19:31:12 A08 Note: got GQCS failure on a dead socket context status=995, socket=532, pcon=000000C9772D4180, state=-1, IP=0.0.0.0
%{MS\_DNS\_DATE:date}\s+%{TIME:time}\s+%{DATA:thread\_id}\s+%{WORD:record\_type}\s+%{GREEDYDATA:description}
Result of this is:
{
"date": "2. 11. 2019",
**"thread\_id": "A08 Note:",**
"description": "GQCS failure on a dead socket context status=995, socket=532, pcon=000000C9772D4180, state=-1, IP=0.0.0.0",
"time": "19:31:12",
"record\_type": "got"
}
there is a space between A08 and Note: So it should parse it to fields:
thread\_id: A08
record\_type: Note:
Thanks
Jan
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 3, 2019, 2:18pm UTC](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285/2 "2019-11-03T14:18:25Z")
Use a more specific pattern than DATA, or parse it using dissect instead of grok.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2019, 2:18pm UTC](https://discuss.elastic.co/t/parsing-problem-one-or-more-space/206285/3 "2019-12-01T14:18:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.