# About FileBeat Dissect processor

**URL:** https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138
**Category:** Beats
**Tags:** filebeat
**Created:** [September 26, 2022, 7:25am UTC](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138 "2022-09-26T07:25:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![aluopy](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aluopy](https://discuss.elastic.co/u/aluopy)
#### Post date: [September 26, 2022, 7:25am UTC](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138/1 "2022-09-26T07:25:24Z")

</div>

HI, I want to use FileBeat's Dissect processor to handle my log simply, but always report an error. The relevant information is as follows:

**Version Info** :

```auto
elasticsearch: 8.4.2
kibana: 8.4.2
filebeat: 8.4.2

```

**filebeat.yml** :

```auto
filebeat.inputs:
- type: filestream
  enabled: true
  id: a9kpfw
  index: a9kpfw
  paths:
    - /tmp/2.log
  parsers:
    - multiline:
        type: pattern
        pattern: '^\[[0-9]{2}-[0-9]{2}-[0-9]{4}'
        negate: true
        match: after
processors:
  - drop_fields:
      fields: ["ecs", "agent", "log", "input", "host"]
  - dissect:
      tokenizer: '"[%{timestamp}] [%{thread}] %{level} %{logger}(%{caller}) - %{msg}"'
      field: "message"
      target_prefix: "a9kpfw"

```

**My log format** :

```auto
[26-09-2022 10:04:43.491] [http-nio-8080-exec-22] INFO com.xxxxxx.xxxx.service.xxxx.xxxxxxxxxxxxxxxxx:com.xxxxxx.xxxx.service.xxxx.xxxxxxxxxxxxxx.xxxxxxxx(xxxxxxxxxxxx.java:1130) - function:xxxxxx& node:xxxxxx& qqlsh:xxxxxx_xxxxxx& xxxxxx:12345678876543& fjh:2& zdh:1& code:0000& msg:xxxxxxxxxx& 

```

**kibana** :

 ![微信图片_20220926151732](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9e23e71ea8e179783c40a40f08151860b1685985.jpeg)  
  
  
I used [this tool](https://www.elastic.co/guide/en/beats/filebeat/master/dissect.html) to analyze patterns, there is no problem.

Please help see what's the problem, thank you

---

<div class="post-metadata">

### Author: ![aluopy](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@aluopy](https://discuss.elastic.co/u/aluopy)
#### Post date: [September 30, 2022, 8:02am UTC](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138/2 "2022-09-30T08:02:40Z")

</div>

Just remove the order number 😅

```auto
tokenizer: "[%{timestamp}] [%{thread}] %{level} %{logger}(%{caller}) - %{msg}"

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2022, 10:03am UTC](https://discuss.elastic.co/t/about-filebeat-dissect-processor/315138/3 "2022-10-28T10:03:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.