# Dissect pattern not found **URL:** \ **Category:** Logstash\ **Created:** [February 27, 2019, 10:39am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143 "2019-02-27T10:39:28Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Post date:** [February 27, 2019, 10:39am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/1 "2019-02-27T10:39:28Z")
I cannot see why this isn't working (other event fields removed for clarity). ```auto Dissector mapping, pattern not found {"field"=>"message", "pattern"=>" [%{level->}] %{}", "event"=>{"message"=>" [WARNING] Test"}} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 27, 2019, 11:11am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/2 "2019-02-27T11:11:30Z")
I think the problem is that there is nothing to tell dissect that -\> refers to one or more spaces. ```auto " [%{level->}]%{}" will match ' [WARNING] ] ]Test' ``` ---
**Author:** ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Post date:** [February 27, 2019, 11:13am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/3 "2019-02-27T11:13:26Z")
From [the documentation](https://www.elastic.co/guide/en/logstash/6.6/plugins-filters-dissect.html): > Note, above, the second field has a `->` suffix which tells Dissect to ignore padding to its right. ---
**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Post date:** [February 27, 2019, 11:16am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/4 "2019-02-27T11:16:16Z")
Surprising! Theoretically it should work. Is there a need to escape the square brackets? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 27, 2019, 11:21am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/5 "2019-02-27T11:21:15Z")
Yes, but the delimiter to its right is a square bracket, not a space. ---
**Author:** ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Post date:** [February 27, 2019, 11:23am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/6 "2019-02-27T11:23:08Z")
I don't think you understand what padding means. It's supposed to capture everything up to the ] delimiter, then rtrim the result. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 27, 2019, 11:28am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/7 "2019-02-27T11:28:12Z")
I don't think you understand what padding means. ``` " [%{level->}]%{}" ``` will match multiple right delimiters. The RHS delimiter here is ], so it matches ``` ' [WARNING]]]Test' ``` For the pattern ``` " [%{level->}] %{}" ``` The RHS delimiter is '] ', so it will match ``` ' [WARNING] ] Test' ``` ---
**Author:** ![OrangeDog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orangedog/32/4630_2.png) [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Post date:** [February 27, 2019, 11:31am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/8 "2019-02-27T11:31:11Z")
If that's true then it's _really_ badly documented. How are you supposed to dissect a space-padded field within some delimiters then? ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [February 27, 2019, 11:32am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/9 "2019-02-27T11:32:56Z")
The delimiter is **all** the characters between the `}` and the next `%{`. The `->` modifier will skip through repeating occurrences of these characters. So a single space character will skip multiple single spaces, a two space delimiter will skip multiple double spaces etc. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [February 27, 2019, 11:33am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/10 "2019-02-27T11:33:33Z")
> [@OrangeDog](#): > > How are you supposed to dissect a space-padded field within some delimiters then? I think you have to grok it rather than dissect it. ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [February 27, 2019, 11:37am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/11 "2019-02-27T11:37:51Z")
or accept the spaces and use another dissect pattern on the field `message => "[%{field_w_spaces}] %{rest}"` then `field_w_spaces => "%{field->} %{}"` and `remove_field => ["field_w_spaces"]` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 27, 2019, 11:37am UTC](https://discuss.elastic.co/t/dissect-pattern-not-found/170143/12 "2019-03-27T11:37:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.