# Unable to extract hostname with Grok using NOTSPACE **URL:** \ **Category:** Logstash\ **Created:** [December 20, 2018, 12:52am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607 "2018-12-20T00:52:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [December 20, 2018, 12:52am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/1 "2018-12-20T00:52:19Z")
Hello, trying to extract a hostname from a log. I test my Grok filter in the Grok debugger using the NOTSPACE pattern and I can extract the hostname "DEV-1010-1010-D-B1F6R01". But in Kibana, I get a "invalid" message for that index pattern. I've already tried to refresh my index patterns with no success. I can extract the other lines from the log file just fine, the hostname in this log line is "DEV-1010-1010-D-B1F6R01" Here is one line from my log: Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "DEV-1010-1010-D-B1F6R01." Here is my grok filter: filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:time\_stamp} %{DATA:app\_source} %{GREEDYDATA:error\_message} %{NOTSPACE:dhcp\_hostname}" } } } Here is the output in Kibana ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/5/75447e4865debdba6c6f9a1ccdcccac51f3057cd.png) Thank you. ---
**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\ **Post date:** [December 20, 2018, 4:49am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/2 "2018-12-20T04:49:16Z")
Does it fetches app\_source ? Also Can you specify delimiters for app\_source and error\_message in the message ? ---
**Author:** ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Post date:** [December 20, 2018, 4:53am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/3 "2018-12-20T04:53:34Z")
Hi, can you post your logs ---
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [December 20, 2018, 5:44pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/4 "2018-12-20T17:44:43Z")
It does fetch app\_source and error\_message, see the delimiters it comes back with below. Here is the log line: Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "HOU-AS01-2960-D-B1F6R01." Delimiters: app\_source:Men and Mice Central error\_message: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server Here is my filter: grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:time\_stamp} %{DATA:app\_source} %{GREEDYDATA:error\_message} %{NOTSPACE:dhcp.hostname}" } } ---
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [December 20, 2018, 5:45pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/5 "2018-12-20T17:45:15Z")
Here is one line of the logs, they all pretty much look the same. Thanks Dec 13 13:33:42 Men and Mice Central: [10640 DHCPSynchronizationThread] Error sending scope list request to DHCP server "HOU-AS01-2960-D-B1F6R01." ---
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [January 8, 2019, 1:04am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/6 "2019-01-08T01:04:45Z")
Update: I was able to use Dissect to retrieve the hostname from the log lines. Here is my filter. dissect { mapping =\> { "message" =\> "%{syslog\_timestamp} %{+syslog\_timestamp} %{+syslog\_timestamp} %{logsource} %{+logsource} %{+logsource} %{+logsource} %{} %{} %{} %{} %{} %{} %{} %{} %{} %{} %{dhcp\_hostname}" } } I need to figure out a way to group the empty fields and avoid having multiple %{} delimiters. Thanks to those that replied. ---
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [January 22, 2019, 4:20pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/7 "2019-01-22T16:20:58Z")
Update to this case. I was able to group fields together. See link below. > [@Filter multiple spaces with a single Dissect field?](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114): > > Hello, I am trying to extract the message part of the event below which starts at "Not able to... " without having to use multiple %{+error\_message} fields but only a single field. Is that possible? 17.01.2019 17:16:23.175 WARN [10.43.32.119 [1547745383173] GET /content/regent.html HTTP/1.1] com.adobe.fd.core.security.internal.CurrentUserServiceImpl Not able to find user for userId [anonymous] my LS config file looks like this and it works but trying to be more efficient with less lines in my … ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 19, 2019, 4:21pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/8 "2019-02-19T16:21:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.