# Dissect Processor not working correctly in elastic search
**URL:** https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738
**Category:** Elasticsearch
**Created:** [May 21, 2020, 12:38pm UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738 "2020-05-21T12:38:51Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)
#### Post date: [May 21, 2020, 12:38pm UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/1 "2020-05-21T12:38:51Z")
Hi Team,
I am trying to parse logs using dissect processor in elastic search . However I dont get the appropriate output. When I run the log through logstash using dissect filter, it works fine.
`
PUT \_ingest/pipeline/my\_pipeline\_id\_saket
{
"description" : "describe pipeline",
"processors" : [
{
"dissect": {
"field": "message",
"pattern": "%{log\_TraceId}, %{log\_SpanId}, %{log\_UserId}, [%{ip},"
}
}
]
}
POST test/\_doc/3?pipeline=my\_pipeline\_id\_saket
{
"message" : "b5721cae-573f-4da5-90dd-2f1c7783b21d, b5721cae-573f-4da5-90dd-2f1c7783b21d, , [0:0:0:0:0:0:0:1,"
}
GET test/\_doc/3
`
This gives the output :-
`"log_TraceId" : "b5721cae-573f-4da5-90dd-2f1c7783b21d", "log_UserId" : "", "ip" : "[0:0:0:0:0:0:0:1", "log_SpanId" : "b5721cae-573f-4da5-90dd-2f1c7783b21d"`
However the output in logstash (correct & expected):-
`{ "ip": "0:0:0:0:0:0:0:1", "log_SpanId": "b5721cae-573f-4da5-90dd-2f1c7783b21d", "log_TraceId": "b5721cae-573f-4da5-90dd-2f1c7783b21d", "log_UserId": "" }`
The Ip address does not get parsed correctly and has a '[' added to it which is a delimiter.
Thanks
Saket
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 22, 2020, 3:59am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/2 "2020-05-22T03:59:39Z")
If I recall correctly I think the dissect pattern need to end with a match clause, so I would recommend adding and empty one at the end and see if that makes a difference.
---
### Author:  [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)
#### Post date: [May 22, 2020, 4:19am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/3 "2020-05-22T04:19:58Z")
Thanks for your reply. Sorry I could not understand " adding and empty one at the end and see if that makes a difference.". Could you please give an example ?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 22, 2020, 4:26am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/4 "2020-05-22T04:26:54Z")
> [@saket\_gupta](#):
>
> "pattern": "%{log\_TraceId}, %{log\_SpanId}, %{log\_UserId}, [%{ip},"
Was on my mobile so could not provide an example. Meant something like this:
```auto
"pattern": "%{log_TraceId}, %{log_SpanId}, %{log_UserId}, [%{ip},%{}"
```
---
### Author:  [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)
#### Post date: [May 22, 2020, 4:30am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/5 "2020-05-22T04:30:31Z")
THanks for your reply. I just did try that unfortunately I still get a '[' in my ip
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [May 22, 2020, 4:35am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/6 "2020-05-22T04:35:10Z")
If the same config in Logstash produces a different result it sounds like a bug.
---
### Author:  [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)
#### Post date: [May 22, 2020, 4:36am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/7 "2020-05-22T04:36:42Z")
Yes it does..!! Thanks for your reply.
---
### Author:  [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)
#### Post date: [May 26, 2020, 4:21am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/8 "2020-05-26T04:21:49Z")
Hi,
Humble Request, if anyone from Elastic Team can look into this ?
Thanks
Saket
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [May 26, 2020, 7:20am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/9 "2020-05-26T07:20:29Z")
If it's a bug, could you open an issue in elasticsearch GitHub repository?
You should link to this thread from the issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 23, 2020, 7:20am UTC](https://discuss.elastic.co/t/dissect-processor-not-working-correctly-in-elastic-search/233738/10 "2020-06-23T07:20:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.