# Dissect failed finding my field in event
**URL:** https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515
**Category:** Logstash
**Created:** [June 29, 2022, 8:53pm UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515 "2022-06-29T20:53:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)
#### Post date: [June 29, 2022, 8:53pm UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515/1 "2022-06-29T20:53:08Z")
Hi experts!!
I have an index mapping like this :
```auto
{
"talend-esb-dev-2022.06" : {
"mappings" : {
"properties" : {
"customInfo" : {
"properties" : {
"camel" : {
"properties" : {
"contextId" : {
"type" : "text"
}
}
}
}
}
}
}
}
}
```
In Logtash, I try to dissect the contextId this way :
```auto
dissect {
mapping => { '[customInfo][camel][contextID]' => "%{projet}.%{domaine}_%{appli_source}_%{appli_cible}_%{reste_a_jeter}" }
}
```
However, when I launch the pipeline, I obtain this error message :
> Dissector mapping, field not found in event {"field"=\>"[customInfo][camel][contextId]", "event"=\>{"org.ops4j.pax.logging.appender.name"=\>"DecanterLogCollectorAppender", "loggerClass"=\>"org.ops4j.pax.logging.slf4j.Slf4jLogger", "input"=\>{"type"=\>"log"}, "serverTimestamp"=\>"2022-06-29T14:54:12.371+02", "felix.fileinstall.filename"=\>"file:/opt/TalendRuntime-8.0.1/runtime/etc/org.apache.karaf.decanter.collector.log.cfg", "loc.file"=\>"JmxManagementStrategy.java", "customInfo"=\>{"bundle.version"=\>"3.11.1", "bundle.name"=\>"org.apache.camel.camel-management", "camel.contextId"=\>"interfaces.cmd001\_gnx\_ids\_0\_1.CMD001\_GNX\_IDS", "bundle.id"=\>"127"}, "@timestamp"=\>2022-06-29T20:44:53.758Z, "error"=\>{"message"=\>"@timestamp not overwritten (parse error on 2022-06-29T12:54:12,371Z)", "type"=\>"json"}, "type"=\>"log", "loc.line"=\>"124", "severity"=\>"INFO", "ignored.categories"=\>"org.apache.karaf.decanter.appender.\*", "eventUUID"=\>"1a7be7a6-61b4-4943-8e01-2f1250763afc", "eventType"=\>"LOGEvent", "name"=\>"log", "agentId"=\>"agent1", "loc.method"=\>"doInit", "event.topics"=\>"decanter/collect/log/org\_apache\_camel\_management\_JmxManagementStrategy", "category"=\>"system", "host"=\>{"name"=\>"ND127"}, "component.id"=\>25, "logMessage"=\>"JMX is enabled", "agent"=\>{"ephemeral\_id"=\>"4f7c4c76-cfd9-421c-abc3-9ffab38637ac", "type"=\>"filebeat", "name"=\>"ND127", "version"=\>"7.10.0", "id"=\>"7a4b2a17-b3a7-4f0e-9af3-8da825964d13", "hostname"=\>"ND127"}, "karafName"=\>"trun", "timestamp"=\>1656507252371, "tags"=\>["beats\_input\_raw\_event"], "hostName"=\>"deb10tredev", "loc.class"=\>"org.apache.camel.management.JmxManagementStrategy", "hostAddress"=\>"127.0.1.1", "component.name"=\>"org.apache.karaf.decanter.collector.log", "threadName"=\>"Blueprint Event Dispatcher: 1", "log"=\>{"file"=\>{"path"=\>"c:\dsrestau\data\em.log"}, "offset"=\>0}, "loggerName"=\>"org.apache.camel.management.JmxManagementStrategy", "service.pid"=\>"org.apache.karaf.decanter.collector.log", "dt\_date\_log"=\>2022-06-29T12:54:12.371Z, "ecs"=\>{"version"=\>"1.6.0"}, "logTimestamp"=\>"2022-06-29T14:54:12.371+02", "@version"=\>"1"}
Could you please help me??
Best regards,
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 29, 2022, 9:32pm UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515/2 "2022-06-29T21:32:03Z")
> [@vincent2mots](#):
>
> `mapping => { '[customInfo][camel][contextID]' =>`
No such field. Try `mapping => { '[customInfo][camel.contextID]' =>`
---
### Author:  [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)
#### Post date: [June 30, 2022, 5:13am UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515/3 "2022-06-30T05:13:22Z")
Thanks it worked!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 28, 2022, 5:14am UTC](https://discuss.elastic.co/t/dissect-failed-finding-my-field-in-event/308515/4 "2022-07-28T05:14:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.