# Dissect processor issue

**URL:** <https://discuss.elastic.co/t/dissect-processor-issue/237278>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 16, 2020, 11:11am UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278 "2020-06-16T11:11:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![paulkeogh](https://avatars.discourse-cdn.com/v4/letter/p/8dc957/32.png) [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\
**Post date:** [June 16, 2020, 11:11am UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278/1 "2020-06-16T11:11:49Z")

</div>

v7.2

When setting target\_prefix to "" (empty string) the output from the dissector does not appear in console. When I set it to anything else, including a single whitespace, it does appear.

Any suggestions ?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [June 16, 2020, 5:44pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278/2 "2020-06-16T17:44:14Z")

</div>

Hey @paulkeogh,

What do you mean by not appearing in console? Do you mean in logs? Could you share an example of what you are seeing with a non empty prefix?

---

<div class="post-metadata">

**Author:** ![paulkeogh](https://avatars.discourse-cdn.com/v4/letter/p/8dc957/32.png) [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\
**Post date:** [June 18, 2020, 1:20pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278/3 "2020-06-18T13:20:54Z")

</div>

Here is my config;

```
 processors:

```

- dissect:  
target\_prefix: "access"  
field: "message"  
tokenizer: '[%{@timestamp}] %{client.ip} %{http.request.method} %{url.original} %{http.response.status\_code} %{http.request.body.bytes} %{http.response.body.bytes}'

With this I get;

.......  
"access": {  
"url": {  
"original": "/v1/xxxx/01b0f411-f7b3-49df-bfc3-322642f7cd77/88a8c554-88ef-4ed0-ba4a-23dde97cf161?channel=ALL&filter=PUBLISHED&page=0&sortField=PUBLISH\_DATE&sortOption=DESC"  
},  
"http": {  
......

When I set target\_prefix to "" , no access element is created in the output document.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [June 18, 2020, 5:31pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278/4 "2020-06-18T17:31:48Z")

</div>

> [@paulkeogh](#):
>
> When I set target\_prefix to "" , no access element is created in the output document.

Do you mean that no "url" element is created?

With this configuration I think that these fields should be placed in `url.original`, `http.request.method` and so on.

Is it possible that some of these fields conflict with some existing field?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 16, 2020, 7:31pm UTC](https://discuss.elastic.co/t/dissect-processor-issue/237278/5 "2020-07-16T19:31:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.