# Variable space working in grok debugger but not in server

**URL:** <https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024>\
**Category:** Logstash\
**Created:** [March 17, 2017, 12:33pm UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024 "2017-03-17T12:33:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![raamee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raamee/32/5110_2.png) [@raamee](https://discuss.elastic.co/u/raamee)\
**Post date:** [March 17, 2017, 12:33pm UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/1 "2017-03-17T12:33:23Z")

</div>

Hi,

My new problem:

Here's my logs:

```
(14529) Login OK: [host] (from client DEVICE-NAME port 13 cli 20-19-44-03-26-c6 via TLS tunnel)
(14529) Login OK: [host] (from client DEVICE-NAME port 13 cli 20-19-44-03-26-c6 via TLS tunnel)

```

You can see the difference between two lines. That is there is an additional space before `Login OK` in the second line. Due to that I'm facing difficulty in Graphs in kibana.( It shows two `Login OK` since there is a space)

My Grok pattern:

`\(%{NOTSPACE:removed}\) +%{GREEDYDATA:AUTH}: \[%{DATA:username}\] \(from client %{NOTSPACE:radius_client} port %{INT:radius_port} (?:cli %{NOTSPACE:radius_cli})?(?: via %{DATA:radius_via})?\)`

I used a `+` infront of `%{GREEDYDATA:AUTH}:` and that is working in Grok debugger online but not in my server.

Any idea?

Thank you.

The output comes as below:

`"AUTH" => " Login OK",`

Please notice the space before `Login OK`

---

<div class="post-metadata">

**Author:** ![andre22](https://avatars.discourse-cdn.com/v4/letter/a/d07c76/32.png) [@andre22](https://discuss.elastic.co/u/andre22)\
**Post date:** [March 17, 2017, 9:34pm UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/2 "2017-03-17T21:34:50Z")

</div>

Hi raamee,

maybe you could strip the space from your field: [https://www.elastic.co/guide/en/logstash/5.2/plugins-filters-mutate.html#plugins-filters-mutate-strip](https://www.elastic.co/guide/en/logstash/5.2/plugins-filters-mutate.html#plugins-filters-mutate-strip)

cheers

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [March 17, 2017, 11:42pm UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/3 "2017-03-17T23:42:58Z")

</div>

@raamee

How about sandwiching the _AUTH_ with space parsing ?

`\(%{NOTSPACE:removed}\)%{SPACE}%{DATA:AUTH}:%{SPACE}\[%{DATA:username}\]`

---

<div class="post-metadata">

**Author:** ![raamee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raamee/32/5110_2.png) [@raamee](https://discuss.elastic.co/u/raamee)\
**Post date:** [March 20, 2017, 4:30am UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/4 "2017-03-20T04:30:00Z")

</div>

Thank you. That did the job.

---

<div class="post-metadata">

**Author:** ![raamee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raamee/32/5110_2.png) [@raamee](https://discuss.elastic.co/u/raamee)\
**Post date:** [March 20, 2017, 4:31am UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/5 "2017-03-20T04:31:12Z")

</div>

Thanks for the answer 🙂 but I have already tried that.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [March 21, 2017, 12:50am UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/6 "2017-03-21T00:50:34Z")

</div>

@raamee

Ok. I am glad that it worked out for you anyway using @andre22‘s idea.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2017, 12:50am UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024/7 "2017-04-18T00:50:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.