# Dissect\_parsing\_error for Apache Tomcat Integration

**URL:** <https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330>\
**Category:** Elastic Agent\
**Tags:** fleet, integrations\
**Created:** [September 28, 2022, 7:36am UTC](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330 "2022-09-28T07:36:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marko\_Todoric](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marko_todoric/32/52975_2.png) [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\
**Post date:** [September 28, 2022, 7:36am UTC](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330/1 "2022-09-28T07:36:13Z")

</div>

Hello everyone,

I'm running 3 node Elasticsearch Cluster with ES Version 8.3.3.  
Elastic Agent is running with same version on Ubuntu 18.04.6 and trying to collect logs from Apache Tomcat 8.5.24 by reading catalina.out file.  
When i look at the ingested data i have standard metadata (with host os information, AWS AMI information etc etc) and `log.flags` field contains `dissect_parsing_error` for each and every line of log.  
When i try to filter out `dissect_parsing_error` i get 0 results.

Log file is something like this

```auto
2022-09-25 06:45:41.259 DEBUG 14556 --- [o-8443-exec-113] c.a.d.p.security.UserDetailsServiceImpl : Method-[UserDetails com.foo.barpoi.security.UserDetailsServiceImpl.loadUserByUsername(String)] Input-[baz]
2022-09-25 06:51:39.949 DEBUG 14556 --- [o-8443-exec-120] c.a.d.p.w.resources.PoiReleaseResources : Method-[PoiReleaseDTO com.foo.bar.poi.web.resources.PoiReleaseResources.getLocalizationRelease(String,String,Principal)] Input-[baz, null, org.springframework.security.authentication.UsernamePasswordAuthenticationToken@9439fff1: Principal: taz Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@7798: RemoteIpAddress: laz; SessionId: null; Granted Authorities: ROLE_API_USER]

```

Could it be due to some different formatting than what grok pattern would expect?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 26, 2022, 7:36am UTC](https://discuss.elastic.co/t/dissect-parsing-error-for-apache-tomcat-integration/315330/2 "2022-10-26T07:36:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.