# Unable to extract hostname with Grok using NOTSPACE **URL:** \ **Category:** Logstash\ **Created:** [December 20, 2018, 12:52am UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607 "2018-12-20T00:52:19Z")\ **Posts on this page:** 1\ **Showing post:** 7
**Author:** ![drivera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drivera/32/39900_2.png) [@drivera](https://discuss.elastic.co/u/drivera)\ **Post date:** [January 22, 2019, 4:20pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607/7 "2019-01-22T16:20:58Z")
Update to this case. I was able to group fields together. See link below. > [@Filter multiple spaces with a single Dissect field?](https://discuss.elastic.co/t/filter-multiple-spaces-with-a-single-dissect-field/165114): > > Hello, I am trying to extract the message part of the event below which starts at "Not able to... " without having to use multiple %{+error\_message} fields but only a single field. Is that possible? 17.01.2019 17:16:23.175 WARN [10.43.32.119 [1547745383173] GET /content/regent.html HTTP/1.1] com.adobe.fd.core.security.internal.CurrentUserServiceImpl Not able to find user for userId [anonymous] my LS config file looks like this and it works but trying to be more efficient with less lines in my … --- _[View the full topic](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607)._