Unable to extract hostname with Grok using NOTSPACE

[drivera (Dion Rivera)]

Update to this case. I was able to group fields together. See link below.

Filter multiple spaces with a single Dissect field?

Hello, I am trying to extract the message part of the event below which starts at "Not able to... " without having to use multiple %{+error_message} fields but only a single field. Is that possible? 17.01.2019 17:16:23.175 WARN [10.43.32.119 [1547745383173] GET /content/regent.html HTTP/1.1] com.adobe.fd.core.security.internal.CurrentUserServiceImpl Not able to find user for userId [anonymous] my LS config file looks like this and it works but trying to be more efficient with less lines in my …