Agent processor dissect question

Elastic Stack Elastic Agent
1

I have an integration using Custom Logs with a processor using this dissect:

- dissect:

 tokenizer: "%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tcpack} %{tcpwin} %{icmptype} %{icmpcode} %{info} %{path} %{pid}"

 field: "message"

 target_prefix: ""

In one log, the last field (pid) is missing so nothing is dissected.

The ignore_missing looks like it would handle “message” missing, but I don’t see an option to tolerate a short message. Is there a way to tolerate a short message?

Thanks.

(Yes, it could be changed to an ingest pipeline, but this was a simple solution, till it wasn’t)

2

No, dissect requires that the message matches the pattern, if the message does not match, it will fail.

But, if I'm not wrong it can have more tokens, just not less tokens.

Since your case what is missing is the last token, maybe you can use a different pattern and capture the path and pid together and process them later in different ways depending if the pid is present or not.

Something like this I think:

"%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tcpack} %{tcpwin} %{icmptype} %{icmpcode} %{info} %{path_and_pid}