# Dissector mapping, field not found
**URL:** https://discuss.elastic.co/t/dissector-mapping-field-not-found/211427
**Category:** Logstash
**Created:** [December 11, 2019, 8:03am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found/211427 "2019-12-11T08:03:36Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Chunbo\_Liao](https://discuss.elastic.co/u/Chunbo_Liao)
#### Post date: [December 11, 2019, 8:03am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found/211427/1 "2019-12-11T08:03:36Z")
my input file as:
file{
path =\> ["/home/11thone/caselog/logmonster/_/_/IPDU\*/GtpSnapshot\*.log",
"/home/11thone/caselog/logmonster/_/_/IPDU\*/mmeDiameter\*.log",
"/home/11thone/caselog/logmonster/_/_/IPDU\*/s1snapshot\*.log"]
type =\> "ipdu"
discover\_interval =\> 15
start\_position =\> "beginning"
sincedb\_path =\> "/home/11thone/elk/logstash/sincedbpath/fnsipdu.txt"
sincedb\_write\_interval =\> 15
}
my filter file as follow:
filter{
dissect {
mapping =\> {"message" =\> "%{LogDate} - %{CaseName} - %{MMEName} - %{Release} - %{UnitName} - %{MessageType} - %{MessageName}:%{Count}"}
}
my output is
output{
stdout { codec =\> rubydebug }
}
and my data file has only two lines as:
2019-05-02 09:25:53 - CAS-32456-K7H8 - MME - NS17.5 - IPDU-0 - S1ap message statistics - Third and Above Level Pagings Sent:0
and the excute result as:
[2019-02-07T01:01:00,014][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}
[2019-02-07T01:01:16,064][WARN][org.logstash.dissect.Dissector] Dissector mapping, field not found in event {"field"=\>"message", "event"=\>{"@timestamp"=\>2019-02-06T17:01:00.057Z, "type"=\>"ipdu"}}
[2019-02-07T01:01:16,067][WARN][org.logstash.dissect.Dissector] Dissector mapping, field not found in event {"field"=\>"message", "event"=\>{"@timestamp"=\>2019-02-06T17:01:00.121Z, "type"=\>"ipdu"}}
/home/11thone/elk/logstash/vendor/bundle/jruby/2.5.0/gems/awesome\_print-1.7.0/lib/awesome\_print/formatters/base\_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"@timestamp" =\> 2019-02-06T17:01:00.057Z,
"type" =\> "ipdu"
}
{
"@timestamp" =\> 2019-02-06T17:01:00.121Z,
"type" =\> "ipdu"
}
I can not find any error related to "Dissector mapping, field not found in event". does it a bug?
is there anyone faced this issue as well?
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [December 11, 2019, 10:22am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found/211427/2 "2019-12-11T10:22:13Z")
I have no experience with that filter, but it seems like it is right to complain about the missing field as the "message" does in fact not exist in your event. The question is why it isn't there. Are there any other configuration files in the same folder that might be part of that Logstash pipeline and delete the message field?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2020, 10:22am UTC](https://discuss.elastic.co/t/dissector-mapping-field-not-found/211427/3 "2020-01-08T10:22:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.