# Agent processor dissect question

**URL:** <https://discuss.elastic.co/t/agent-processor-dissect-question/383995>\
**Category:** Elastic Agent\
**Created:** [December 11, 2025, 5:11pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995 "2025-12-11T17:11:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [December 11, 2025, 5:11pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995/1 "2025-12-11T17:11:02Z")

</div>

I have an integration using Custom Logs with a processor using this dissect:

> - dissect:
> 
> ```
> tokenizer: "%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tcpack} %{tcpwin} %{icmptype} %{icmpcode} %{info} %{path} %{pid}"
> 
> field: "message"
> 
> target_prefix: ""
> 
> ```

In one log, the last field (pid) is missing so nothing is dissected.

The ignore\_missing looks like it would handle “message” missing, but I don’t see an option to tolerate a short message. Is there a way to tolerate a short message?

Thanks.

(Yes, it could be changed to an ingest pipeline, but this was a simple solution, till it wasn’t)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 11, 2025, 5:25pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995/2 "2025-12-11T17:25:19Z")

</div>

> [@rugenl](#):
>
> Is there a way to tolerate a short message?

No, `dissect` requires that the message matches the pattern, if the message does not match, it will fail.

But, if I'm not wrong it can have more tokens, just not less tokens.

Since your case what is missing is the last token, maybe you can use a different pattern and capture the path and pid together and process them later in different ways depending if the pid is present or not.

Something like this I think:

```auto
"%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tcpack} %{tcpwin} %{icmptype} %{icmpcode} %{info} %{path_and_pid}

```