# Dissect field with unknown length?

**URL:** <https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643>\
**Category:** Logstash\
**Created:** [August 3, 2019, 4:40pm UTC](https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643 "2019-08-03T16:40:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [August 3, 2019, 4:40pm UTC](https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643/1 "2019-08-03T16:40:49Z")

</div>

Hi,

Based on other posts I've made, I've learned that I should be able `dissect` a field (in this case, it's `eventData.ObjectName` into sub-fields, however I'm having an issue where some messages don't have the full length of my `dissect`, and therefore throw a `_dissectfailure`

My dissect is as follows:

```auto
if [eventData.ObjectName] =~ "folder1\/folder2" {
            dissect { mapping => { "eventData.ObjectName" => "%{share_name}/%{folder1}/%{folder2}/%{customername}/%{objectname}" } }
        }

```

Sample messages in field:

```auto
(share);/folder1/folder2/customer1
(share);/folder1/folder2/customer1/file1.txt
(share);/folder1/folder2/customer1/file2.txt
(share);/folder1/folder2/customer2
(share);/folder1/folder2/customer2/file1.txt

```

What I'm seeing is that the messages in the example: 2, 3, and 5 will parse fine, but 1 and 4 will throw the failure. Note, this won't break, but I'm dealing with ~100,000 messages per minute, so I need this to be efficient, accurate, and now throw failures. Thanks in advance.

Hope you don't mind if I mention you @Badger since you're extremely helpful. I owe you a beer (or something else if you don't drink).

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 3, 2019, 4:55pm UTC](https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643/2 "2019-08-03T16:55:01Z")

</div>

As the documentation notes, you can make application of the dissect conditional upon the field matching the pattern. For example

```
    if [message] =~ /\/[^\/]+\/[^\/]+\/[^\/]+\// {
        dissect { mapping => { "message" => "%{share_name}/%{folder1}/%{folder2}/%{customername}/%{objectname}" } }
    } else {
        dissect { mapping => { "message" => "%{share_name}/%{folder1}/%{folder2}/%{customername}" } }
    }

```

Alternatively (and this would be my preference), dissect off the fixed prefix and conditionally do a second dissect.

```
    dissect { mapping => { "message" => "%{share_name}/%{folder1}/%{folder2}/%{customername}" } }
    if [customername] =~ /\// {
        dissect { mapping => { "customername" => "%{customername}/%{objectname}" } }
    }
```

---

<div class="post-metadata">

**Author:** ![eclipsed450](https://avatars.discourse-cdn.com/v4/letter/e/b5e925/32.png) [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\
**Post date:** [August 3, 2019, 5:37pm UTC](https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643/3 "2019-08-03T17:37:00Z")

</div>

> [@Badger](#):
>
> `dissect { mapping => { "message" => "%{share_name}/%{folder1}/%{folder2}/%{customername}" } } if [customername] =~ /\// { dissect { mapping => { "customername" => "%{customername}/%{objectname}" } } }`

Thank you, I chose this method, with a few modifications:

```auto
        if [eventData.ObjectName] =~ "folder1" {
            dissect { mapping => { "eventData.ObjectName" => "%{eventData.share.name}/%{eventData.ObjectName.folder1}/%{eventData.ObjectName.folder2}/%{eventData.ObjectName.customername}" } }
            if [customer.name] =~ /\// {
                 dissect { mapping => { "eventData.ObjectName.customername" => "%{eventData.ObjectName.customername}/%{eventData.ObjectName.filepath}" } }
            }
        }
        else if [eventData.ObjectName] {
            dissect { mapping => { "eventData.ObjectName" => "%{eventData.share.name}/%{eventData.filepath}" } }
        }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2019, 5:37pm UTC](https://discuss.elastic.co/t/dissect-field-with-unknown-length/193643/4 "2019-08-31T17:37:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.