# Dissector mapping field not found in event

**URL:** https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179
**Category:** Logstash
**Created:** [July 20, 2021, 3:16pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179 "2021-07-20T15:16:47Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:16pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/1 "2021-07-20T15:16:47Z")

</div>

Hi, I used the dissect filter and it worked .Now it does not.  
The only change is the upgrate of mac Os Catalina to mac OS Big Sur v 11.4  
A message is displayed : Dissector mapping field not found in event  
Could you help me.

PG

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [July 20, 2021, 3:20pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/2 "2021-07-20T15:20:44Z")

</div>

Can you post your config/sample data and a few log messages from logstash?

`Dissector mapping field not found in event` means that the field that you are trying to dissect is not in the data that is being ingested.

Have you looked at your data in the standard output to ensure your incoming data has not changed since your upgrade?

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:23pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/3 "2021-07-20T15:23:47Z")

</div>

here my logstash config :input{  
stdin{}  
}

filter {  
dissect {  
mapping =\> {  
"message" =\> '%{?messageBis} \<form %{messageBis1}'  
"messageBis1" =\> '%{field1}%{?field2}%{field3}%{?field4}%{field5}'

```
}

remove_field => ["message"]

```

}

}

output {

```
stdout { codec => rubydebug }

```

}

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:32pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/4 "2021-07-20T15:32:40Z")

</div>

And a part of my sample

| Créée le | &nbsp;2013-05-23 09:32:20 |
| Libellé | &nbsp;thermocouples |
| Etat actuel | &nbsp;0 |
| Commentaire |
| |
| Service | &nbsp;/DR/ICAA |
| Nom du rédacteur | &nbsp;Sawsane NAKOUZI |
| Numéro commande | &nbsp; |
| Bénéficiaire | 

| Sawsane NAKOUZI | | |

 |
| Délai de livraison | &nbsp;91468 |
| Code analytique principal | | &nbsp;ARMINES-CROMEP |
| Code analytique secondaire | | &nbsp; |
| Pieces jointes | Aucune |

| Informations sur le fournisseur&nbsp; |
| --- |
| Nom | &nbsp;NEWPORT OMEGA |
| Adresse \* | 11 rue Jacques Cartier 78280 GUYANCOURT France |
| Téléphone | &nbsp;0161372900 |
| Fax | &nbsp;0130575427 |

| Type de la DA | 

| ARMINES |
| CNRS |

 |
| Ctre commun Armines | &nbsp; |
| No Contrat | &nbsp;92751 |
| Nom Contrat | &nbsp;Toshiba |
| Financement (Inv.DR) | &nbsp; |

| Achat relevant de la procédure d'hygiène et sécurité | OUI | NON |

| N° | Désignation | Code nomenclature | Référence | Quantité | PU HT | TVA | Total HT | Total TTC |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 1 | Alumel | 

| | | &nbsp; |

 | TFAL-003-100 | 1.00 | 29.00 | 19.6 | 29.00 | 34.68 |
| 2 | chromel | 

| | | &nbsp; |

 | TFCY-003-100 | 1.00 | 29.00 | 19.6 | 29.00 | 34.68 |
| | TOTAUX (EUR) | 
11.36
 | 
58
 | 
69.36
 |
| --- | --- | --- | --- | --- |
| ATTENTION, Cette application n'est a utiliser QUE POUR LES DA CNRS ou ARMINES RAPSODEE, mais PAS POUR CELLES ARMINES ICAA OU EPA !!! |
| --- |
| Pour TOUTES les autres DA : [https://sirepa-prod.mines-telecom.fr](https://sirepa-prod.mines-telecom.fr) |
| --- |
| HistoriqueCopier |

 Informations sur la procédure de consultation (pour DA de montant \> 4000 EUR HT)

| Descriptif technique |
| |

| Fournisseurs consultés |
| |
| Raisons du choix du fournisseur |
| |

| Historique de la DA No 17758 à partir de l'état 1 |
| --- |
| Date | Auteur | Commentaire | Etat final |
| --- | --- | --- | --- |

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:33pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/5 "2021-07-20T15:33:22Z")

</div>

It worked, why it does not ?

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [July 20, 2021, 3:37pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/6 "2021-07-20T15:37:02Z")

</div>

> [@gongon](#):
>
> "messageBis1" =\> '%{field1}%{?field2}%{field3}%{?field4}%{field5}'

My guess is that this field is the one that is complaining about because `messageBis1` is not a standard field. It may be a good idea to disable all filters and just have an input/output in your logstash config and see what logstash is getting.

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:54pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/7 "2021-07-20T15:54:48Z")

</div>

I get the differents fields indicated in the config and I have to keep on going the sample 'dissection.

{  
"@version" =\> "1",  
"field3" =\> "\n\<td valign=\"top\"\>\n\<table class=\"DA\_DG\"\>\n\<th class=\"soustitre\" colspan=2\>Informations sur le fournisseur&nbsp;\n\<input class=\"petit\_bouton\" type=button onClick=\"recherche('fournisseur')\" value=\"...\"\>\n\<td class=\"libelle\"\>Nom\n \<input type=hidden id=\"four\_nom\" name=\"four\_nom\" value=\"GROSSERON SAS\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;GROSSERON SAS\n \<td class=\"libelle\"\>Adresse \*\n\<textarea class='normal' name='four\_adr' id='four\_adr'rows=3\"\>ZAC Hauts de Coueron III - Secteur 4\r\n4 rue des entrepreneurs\r\n44220 COU\xCBRON - FRANCE\<td class=\"libelle\"\>T\xE9l\xE9phone\n \<input type=hidden id=\"four\_tel\" name=\"four\_tel\" value=\"33 (0) 2 40 92 07 09\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;33 (0) 2 40 92 07 09\n \<td class=\"libelle\"\>Fax\n \<input type=hidden id=\"four\_fax\" name=\"four\_fax\" value=\"33 (0) 2 40 92 07 10\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;33 (0) 2 40 92 07 10\n ",  
"@timestamp" =\> 2021-03-19T16:45:01.499Z,  
"field5" =\> "\<td class=\"libelle\"\>Ctre commun Armines\n \<input type=hidden id=\"ccarmines\" name=\"ccarmines\" value=\"\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;\n \<td class=\"libelle\"\>No Contrat\n \<input type=hidden id=\"code\_contrat\" name=\"code\_contrat\" value=\"20000270\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;20000270\n \<td class=\"libelle\"\>Nom Contrat\n \<input type=hidden id=\"nom\_contrat\" name=\"nom\_contrat\" value=\"MAANEO\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;MAANEO\n \<td class=\"libelle\"\>Financement (Inv.DR)\n \<input type=hidden id=\"financement\_dr\" name=\"financement\_dr\" value=\"\"\>\n \n \<td class=\"lecture\_seule\"\>&nbsp;\n \<td colspan=\"2\"\>\<table width=\"100%\" bgcolor=\"pink\"\>\n\n\n\n

| Achat relevant de la proc\xE9dure d'hygi\xE8ne et s\xE9curit\xE9 | \<input name='hygiene' type=radio value=\"1\"\>OUI | \<input name='hygiene' type=radio value=\"0\" CHECKED\>NON |

\n\n\<table width=\"100%\" border=\"1\"\>\n\<tr class=\"soustitre\"\>\nN\xB0\nD\xE9signation\nCode nomenclature\nR\xE9f\xE9rence\nQuantit\xE9\nPU HT\nTVA\nTotal HT\nTotal TTC\n\n\<tr id=\"ligne\_article\_1\" class=\"article\"\>\<input type='hidden' name='id\_article\_0' value=\"51526\"\>1BAC DE RETENTION LABO-RETEN 60L AVEC CAILLEBOTIS PLASTIQUE GRIS ARGENT\<table border=\"1\"\>\n \<input type=hidden id=\"nomenclature\_code\_0\" name=\"nomenclature\_code\_0\" value=\"\"\>\n \<td class=\"lecture\_seule\"\>&nbsp;\n B032927\n 1.00\n \<td width=\"2em\"\>121.16\n 20\n 121.16\n 145.39\n \n \<tr id=\"ligne\_article\_2\" class=\"article\"\>\<input type='hidden' name='id\_article\_1' value=\"51527\"\>2Frais de transport\<table border=\"1\"\>\n \<input type=hidden id=\"nomenclature\_code\_1\" name=\"nomenclature\_code\_1\" value=\"\"\>\n \<td class=\"lecture\_seule\"\>&nbsp;\n 708501\n 1.00\n \<td width=\"2em\"\>22.00\n 20\n 22.00\n 26.40\n \n \n \<th colspan=\"2\"\>\n \<input type=\"button\" class=\"bouton\" onClick=\"montrer();\" id=\"20lignes\" value=\"20 lignes\"\>\n\<input type=\"button\" class=\"petit\_bouton\" onClick=\"cacher();\" id=\"10lignes\" value=\"10 lignes\"\>\n\<th colspan=\"4\"\>\nTOTAUX (EUR)\n\<th width=\"2em\" align=\"right\" bgcolor=\"orange\"\>
28.63
\n\<th width=\"2em\" align=\"right\" bgcolor=\"orange\"\>
143.16
\n\<th width=\"2em\" align=\"right\" bgcolor=\"orange\"\>
171.79
\n\<input type=hidden name=\"totalHT\" id=\"totalHT\" value='0'\>\n\<input type=hidden name=\"totalTVA\" id=\"totalTVA\" value='0'\>\n\<input type=hidden name=\"totalTTC\" id=\"totalTTC\" value='0'\>\n\<th bgcolor=\"red\" colspan=\"10\"\>ATTENTION, Cette application n'est a utiliser QUE POUR LES DA CNRS ou ARMINES RAPSODEE, mais PAS POUR CELLES ARMINES ICAA OU EPA !!!\n \<th bgcolor=\"red\" colspan=\"10\"\>Pour TOUTES les autres DA : \n \<a href=\"https://sirepa-prod.mines-telecom.fr\"\>https://sirepa-prod.mines-telecom.fr\<td align=\"center\" colspan=\"10\"\>\<a href=\"da.cgi?IdDa=24530&Action=HistoriqueDemande\" class=\"bouton\"\>Historique\<a href=\"da.cgi?IdDa=24530&Action=CopierDemande\" class=\"bouton\"\>Copier\n \<th class=\"soustitre\" colspan=2\>Informations sur la proc\xE9dure de consultation (pour DA de montant \> 4000 EUR HT)\n\<tr valign=\"top\"\>\n\<table class=\"DA\_DG\"\>\n\<td class=\"libelle\"\>Descriptif technique\n\<textarea class=\"saisie\" name=\"descriptif\" id=\"descriptif\" rows=9\>\n\n\<table class=\"DA\_DG\"\>\n\<td class=\"libelle\"\>Fournisseurs consult\xE9s\n\<textarea class=\"saisie\" name=\"fournisseurs\" id=\"fournisseurs\" rows=3\>\n\<td class=\"libelle\"\>Raisons du choix du fournisseur\n\<textarea class=\"saisie\" name=\"raisons\" id=\"raisons\" rows=5\>\n\n\<td colspan=\"2\"\>\<table class=\"historique\"\>\n \<th class=\"titre\" colspan=\"4\"\>\n Historique de la DA No 24530 \xE0 partir de l'\xE9tat 1\n \n DateAuteurCommentaireEtat final\n Le 03/02/2021 \xE0 09:48\n \n Changement \xE9tat\n 1 (en attente de validation par responsable de niveau 1)\n \n \n Le 03/02/2021 \xE0 10:38\n \n mise\_a\_jour\n 1 (en attente de validation par responsable de niveau 1)\n \n   
\<input class=\"bouton\" type=button onClick=\"javascript: history.back();\" value=\"Retour\"\>\n\n\<script langage=\"javascript\"\>calculerPrix(this.form);\n \n ",

etc ...

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 3:55pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/8 "2021-07-20T15:55:42Z")

</div>

I got and now it does not work.

---

<div class="post-metadata">

### Author: ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [July 20, 2021, 6:32pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/9 "2021-07-20T18:32:10Z")

</div>

Oh I see.  
Can you please post more detailed log entries of the error you are getting?

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 7:33pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/10 "2021-07-20T19:33:46Z")

</div>

Sure.  
Here more details 🙂

WARN ][org.logstash.dissect.Dissector][main] Dissector mapping, field found in event but it was empty {"field"=\>"message", "event"=\>{"host"=\>"I5951.local", "message"=\>"", "@version"=\>"1", "@timestamp"=\>2021-07-20T13:33:15.563Z, "tags"=\>["\_dissectfailure"]}}  
[2021-07-20T15:33:16,933][WARN][org.logstash.dissect.Dissector][main] Dissector mapping, field not found in event {"field"=\>"messageBis1", "event"=\>{"host"=\>"I5951.local", "message"=\>"", "@version"=\>"1", "@timestamp"=\>2021-07-20T13:33:15.563Z, "tags"=\>["\_dissectfailure"]}}  
[2021-07-20T15:33:16,943][WARN][org.logstash.dissect.Dissector][main] Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{?messageBis} \<form %{messageBis1}", "event"=\>{"host"=\>"I5951.local", "message"=\>" ", "@version"=\>"1", "@timestamp"=\>2021-07-20T13:33:15.609Z, "tags"=\>["\_dissectfailure"]}}  
[2021-07-20T15:33:16,946][WARN][org.logstash.dissect.Dissector][main] Dissector mapping, field not found in event {"field"=\>"messageBis1", "event"=\>{"host"=\>"I5951.local", "message"=\>" ", "@version"=\>"1", "@timestamp"=\>2021-07-20T13:33:15.609Z, "tags"=\>["\_dissectfailure"]}}  
[2021-07-20T15:33:16,950][WARN][org.logstash.dissect.Dissector][main] Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{?messageBis} \<form %{messageBis1}", "event"=\>{"host"=\>"I5951.local", "message"=\>" ", "@version"=\>"1", "@timestamp"=\>2021-07-20T13:33:15.609Z, "tags"=\>["\_dissectfailure"]}}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 20, 2021, 7:38pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/11 "2021-07-20T19:38:07Z")

</div>

> [@gongon](#):
>
> Dissector mapping, field found in event but it was empty {"field"=\>"message" ... "message"=\>""
> 
> Dissector mapping, field not found in event {"field"=\>"messageBis1",
> 
> Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{?messageBis} \<form %{messageBis1}", ... "message"=\>" "

The first indicates, as it says, that the [message] is empty.

The second suggests that you are assuming that your dissect always works, and then trying a second dissect even when the field it tries to dissect was not created by the first dissect. You should check whether the field exists.

The third tell you that the [message] field contains a single space, so the pattern does not match.

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 7:46pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/12 "2021-07-20T19:46:53Z")

</div>

Yes the pattern does not work now but it did with the same sample and the same code.The only change I do is the upgrade of mac OS.coud it be the reason of that?

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 20, 2021, 8:02pm UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/13 "2021-07-20T20:02:02Z")

</div>

OK I will come back to work

---

<div class="post-metadata">

### Author: ![gongon](https://avatars.discourse-cdn.com/v4/letter/g/ecccb3/32.png) [@gongon](https://discuss.elastic.co/u/gongon)
#### Post date: [July 21, 2021, 6:59am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/14 "2021-07-21T06:59:16Z")

</div>

Night advises.Thank tou very much for your answers.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 18, 2021, 7:00am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found-in-event/279179/15 "2021-08-18T07:00:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.