# Discect rule with a "+" sign in the message, can't escape it

**URL:** <https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661>\
**Category:** Kibana\
**Created:** [July 18, 2023, 11:15am UTC](https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661 "2023-07-18T11:15:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![UPPERCASE](https://avatars.discourse-cdn.com/v4/letter/u/ee7513/32.png) [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\
**Post date:** [July 18, 2023, 11:15am UTC](https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661/1 "2023-07-18T11:15:07Z")

</div>

I have the following disect rule: `%{timestamp} queries: info: client @%{dns_client} %{source_ip}#%{source_port} (%{query}): query: %{query_2} IN %{class} + (%{dns_server})`, which is from a BIND DNS server (querylog).

Which splits the querylogs into these fields:

```json
{
  "docs": [
    {
      "doc": {
        "_index": "index",
        "_id": "id",
        "_version": "-3",
        "_source": {
          "dns_client": "0x80",
          "@timestamp": "2023-07-18T13:12:50.570+02:00",
          "source_port": "37651",
          "query": "nodename",
          "query_2": "nodename",
          "dns_server": "x.x.x.x",
          "message": "18-Jul-2023 13:12:50.570 queries: info: client @0x80 x.x.x.x#37651 (tcn11-xcc): query: nodename IN AAAA + (x.x.x.x)",
          "class": "AAAA +",
          "source_number": "37651",
          "source_ip": "x.x.x.x"
        },
        "_ingest": {
          "timestamp": "2023-07-18T11:12:43.590896651Z"
        }
      }
    }
  ]
}

```

I don't get why ` "class": "AAAA +"` includes the "+". Can someone point me to my mistake?

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [July 18, 2023, 2:10pm UTC](https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661/2 "2023-07-18T14:10:10Z")

</div>

Do you also have a few samples from the log lines that you're processing? It will make debug easier.

---

<div class="post-metadata">

**Author:** ![UPPERCASE](https://avatars.discourse-cdn.com/v4/letter/u/ee7513/32.png) [@UPPERCASE](https://discuss.elastic.co/u/UPPERCASE)\
**Post date:** [July 19, 2023, 8:36am UTC](https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661/3 "2023-07-19T08:36:05Z")

</div>

Thanks for your reply! I found the issue already, there was another ingest pipeline that split the lines the wrong way. This caused the confusion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2023, 8:37am UTC](https://discuss.elastic.co/t/discect-rule-with-a-sign-in-the-message-cant-escape-it/338661/4 "2023-08-16T08:37:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.