# Dissect in logstash and tabs
**URL:** https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595
**Category:** Logstash
**Created:** [December 18, 2023, 8:36pm UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595 "2023-12-18T20:36:47Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@astateofmind](https://discuss.elastic.co/u/astateofmind)
#### Post date: [December 18, 2023, 8:36pm UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595/1 "2023-12-18T20:36:47Z")
Trying to use dissect to add log.level field to some beats.
Using filebeat to send the data and some logs have their fields separated by tabs instead of spaces.
The logs with space work ok with this filter:
"%{} %{log.level-\>} %{}"
If I try something similar:
"%{}\t%{log.level-\>}\t[%{}"
I get the warn:
pattern"=\>"%{}\t%{log.level-\>}\t%{} = not found.
Weird that if I try that in [https://dissect-tester.jorgelbg.me](https://dissect-tester.jorgelbg.me) it seems to work ok ...
Any ideas why it does that to \t and what to use instead?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [December 18, 2023, 9:24pm UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595/2 "2023-12-18T21:24:45Z")
Can you share some sample logs and the configuration you are using in Logstash?
Also, is it a typo? The patterns you shared are different, one has a `[%{}` and the other does not have it.
---
### Author:  [@astateofmind](https://discuss.elastic.co/u/astateofmind)
#### Post date: [December 18, 2023, 10:54pm UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595/3 "2023-12-18T22:54:02Z")
Yes, it was a typo, corrected.
The error is:
```auto
"org.logstash.dissect.Dissector][main][e5c3abef8a6cef340816f3cd3afa186880e34a70a6ed6301de76a9436ec9c59b] Dissector mapping, pattern not found {"field"=>"message", "pattern"=>"%{}\\t%{log.level}\\t%{}"
```
Ad the pattern was how it's above, apparently is adds and extra \ for some reason.
I did a mutate prior to pattern matching, replacing \t with " " and it works ok now matching the " " so I guess for now I can live with that ...
Still, weird that \t is not accepted.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 19, 2023, 2:29am UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595/4 "2023-12-19T02:29:56Z")
dissect does not support any form of regexp or character escapes. The reason it is so much faster than grep is that it simply scans forward through the field looking for the next delimiter it expects. So, yes, you need a literal tab in the pattern.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2024, 2:29am UTC](https://discuss.elastic.co/t/dissect-in-logstash-and-tabs/349595/5 "2024-01-16T02:29:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.