What is the actual difference between dissect filter and dissect processor and they both seem to have same functionality and different syntax.
Syntax for dissect filter plugin .
filter {
dissect {
mapping => {
"message" => "%{ts} %{+ts} %{+ts} %{src} %{} %{prog}[%{pid}]: %{msg}"
}
}
}
Syntax for Dissect processor.
{
"dissect": {
"field": "message",
"pattern" : "%{clientip} %{ident} %{auth} [%{@timestamp}] "%{verb} %{request} HTTP/%{httpversion}" %{status} %{size}"
}
}