# Skip one o more tabs & in grok?
**URL:** https://discuss.elastic.co/t/skip-one-o-more-tabs-in-grok/88299
**Category:** Logstash
**Created:** [June 5, 2017, 4:22pm UTC](https://discuss.elastic.co/t/skip-one-o-more-tabs-in-grok/88299 "2017-06-05T16:22:31Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)
#### Post date: [June 5, 2017, 4:22pm UTC](https://discuss.elastic.co/t/skip-one-o-more-tabs-in-grok/88299/1 "2017-06-05T16:22:31Z")
can someone please advise how to skip one or more tabs coming in input log line ?
**I/P** - [2017-06-05 12:16:08,353] :|: INFO :|: [lvprdsnbfe1.lv.jabodo.com](http://lvprdsnbfe1.lv.jabodo.com) :|: :|: :|:\n\t\t\t\t :|: :|: c.m.c.PeriodicProductDataRefresher :|: - Product data is up to date, no refresh was conducted
input {
beats {
port =\> 5044
codec =\> multiline {
pattern =\> "^[%{TIMESTAMP\_ISO8601}]"
negate =\> true
what =\> previous
}
}
}
filter {
grok {
match =\> { "message" =\> "[%{TIMESTAMP\_ISO8601:timestamp\_match}]%{SPACE}:|:%{SPACE}%{WORD:level}%{SPACE}:|:%{SPACE}%{USERNAME:hostname}%{SPACE}:|:%{SPACE}%{GREEDYDATA:coidkey}%{SPACE}:|:%{SPACE}%{GREEDYDATA:clientinfo}%{SPACE}:|:%{SPACE}%{GREEDYDATA:clientip}%{SPACE}:|:%{SPACE}%{GREEDYDATA:Url}%{SPACE}:|:%{SPACE}%{JAVACLASS:class}%{SPACE}:|:%{SPACE}%{USER:ident}%{SPACE}%{GREEDYDATA:msg}"}
}
}
Grok is not able to work after \n\t\t\t\t ...if i remove that tabs then it works fine .
Thanks.
---
### Author:  [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)
#### Post date: [June 5, 2017, 7:02pm UTC](https://discuss.elastic.co/t/skip-one-o-more-tabs-in-grok/88299/2 "2017-06-05T19:02:22Z")
Was able to skip it with mutate-gsub .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2017, 7:02pm UTC](https://discuss.elastic.co/t/skip-one-o-more-tabs-in-grok/88299/3 "2017-07-03T19:02:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.