# Remove white spaces from fields - Logstash

**URL:** <https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177>\
**Category:** Logstash\
**Created:** [February 16, 2018, 1:29pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177 "2018-02-16T13:29:55Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [February 16, 2018, 1:29pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/1 "2018-02-16T13:29:55Z")

</div>

Message line:  
key1=val1, key2=val2, key3=val3

Below is my logstash filter:

```
filter {

```

grok {  
"match" =\> { "message" =\> "%{SYSLOGTIMESTAMP:msg\_timestamp} %{GREEDYDATA:kvFields}"  
}  
}  
kv {  
source =\> "kvFields"  
field\_split =\> ","  
trim\_key =\> " "  
trim\_value =\> " "  
}  
}

Logstash Output:

{  
"key1" =\> "val1",  
" key2" =\> "val2",  
" key3" =\> "val3"  
}  
Here i want to remove spaces in all fields. I tried with trim\_key =\> "\s" in kv filter. still no luck.

Please help to remove spaces in all logstash fields if there is any other approach.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 1:47pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/2 "2018-02-16T13:47:22Z")

</div>

Have you tried

```
field_split => ", "

```

?

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [February 16, 2018, 1:48pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/3 "2018-02-16T13:48:55Z")

</div>

i am getting wrong output with this. In my message i have few fields which include " ". I need another approach. Found "strip " in mutate. But how to iterate it to apply this to all my fields?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 1:59pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/4 "2018-02-16T13:59:13Z")

</div>

> i am getting wrong output with this. In my message i have few fields which include " ".

Please give an example.

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [February 16, 2018, 2:08pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/5 "2018-02-16T14:08:16Z")

</div>

my actualy msg line:

input message:  
key1=first value key2=second value key3=value3

I did mutate gsub to make this ',' seperated kv msg line.

mutate {  
gsub =\> ["kvFields", "(\S+=)", ", \1"]  
}

now my new msg line is:  
key1=first value, key2=second value, key3=value3

now i am applying kv filter on this msg line:  
kv {  
source =\> "kvFields"  
field\_split =\> ","  
trim\_key =\> " "  
trim\_value =\> " "  
}

for this my output is:

{  
"key1" =\> "first value",  
" key2" =\> "second value"  
" key3" =\> "third value"  
}

But output fields containing spaces.

If i make field\_split=", " i am getting output as:

{  
"key1" =\> "first",  
"key2" =\> "second"  
"key3" =\> "third"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 16, 2018, 2:30pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/6 "2018-02-16T14:30:07Z")

</div>

Ah, damn it. I forgot how `field_split` works. You can use a ruby filter to strip all keys and/or values without having to enumerate them in the configuration.

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [February 16, 2018, 4:08pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/7 "2018-02-16T16:08:20Z")

</div>

can u pls guide me how to loop all fields with ruby filter to apply strip on all keys? I am no way able to make this.

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [February 16, 2018, 6:44pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/8 "2018-02-16T18:44:07Z")

</div>

I tried this:

ruby {  
code =\> '  
event.each do |key, value|  
mutate {  
strip =\> [key]  
}  
end  
'  
}

Got syntax error:

SyntaxError: (ruby filter code):4: syntax error, unexpected tASSOC  
strip =\> [key]  
^

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2018, 6:44pm UTC](https://discuss.elastic.co/t/remove-white-spaces-from-fields-logstash/120177/9 "2018-03-16T18:44:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.