# Dissector mapping, pattern not found error

**URL:** <https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904>\
**Category:** Logstash\
**Created:** [January 22, 2021, 10:47am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904 "2021-01-22T10:47:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shubha](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@Shubha](https://discuss.elastic.co/u/Shubha)\
**Post date:** [January 22, 2021, 10:47am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904/1 "2021-01-22T10:47:44Z")

</div>

Hi All,

I am having the ELK version 7.10 on ec2 instances.  
facing the below error in logstash-plain.log. Can anyone help me on this.

```auto
[2021-01-22T10:29:00,423][WARN][org.logstash.dissect.Dissector][main][1cbe1dfc036a21234e56451763ca81e1416abb2a094feb5ed5d1dbefd461c2e5] Dissector mapping, pattern not found {"field"=>"message", "pattern"=>"%{WORD:event_type} %{NUMBER:time_stamp} %{DATA:REQUEST_ID} %{DATA:ORGANIZATION_ID} %{DATA:USER_ID} %{NUMBER:RUN_TIME} %{NUMBER:CPU_TIME} %{DATA:URI} %{DATA:SESSION_KEY} %{DATA:LOGIN_KEY} %{DATA:REQUEST_STATUS} %{NUMBER:DB_TOTAL_TIME} %{DATA:JOB_ID} %{DATA:ENTRY_POINT} %{TIMESTAMP_ISO8601:TIMESTAMP_DERIVED} %{DATA:USERID_DERIVED} %{IP:CLIENT_IP} %{DATA:URI_ID_DERIVED} %{}", "event"=>{"tags"=>["_dissectfailure"], "@timestamp"=>2021-01-22T10:28:59.904Z, "host"=>"ip-10-218-2-13.eu-west-1.compute.internal", "@version"=>"1", "message"=>"\"QueuedExecution\",\"20210122081531.598\",\"4_lzkE_0xNkvgvX2-pPuc-\",\"00Df2000001Ggxq\",\"005f20000097sks\",\"571\",\"329\",\"SerialBatchApexRangeChunkHandler\",\"\",\"\",\"\",\"164746508\",\"7074O0000BC6XjC\",\"TPM_RefreshProductAndCustomerBatch\",\"2021-01-22T08:15:31.598Z\",\"005f20000097sksAAA\",\"\",\"\"", "path"=>"/opt/sfs_sandbox_logs_hourly_AMS/QueuedExecution/sfdc-hourly-2021-01-22T10:13:21.csv"}} 

```

Regards,  
Shubha

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 22, 2021, 1:25pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904/2 "2021-01-22T13:25:40Z")

</div>

This error happens because your message does not match your dissect mapping.

From your error log, your dissect mapping is, which is already wrong, this seems like from a grok filter, in dissect you do not use the regex patterns like `WORD`, `NUMBER`, `DATA` etc.

```auto
%{WORD:event_type} %{NUMBER:time_stamp} %{DATA:REQUEST_ID} %{DATA:ORGANIZATION_ID} %{DATA:USER_ID} %{NUMBER:RUN_TIME} %{NUMBER:CPU_TIME} %{DATA:URI} %{DATA:SESSION_KEY} %{DATA:LOGIN_KEY} %{DATA:REQUEST_STATUS} %{NUMBER:DB_TOTAL_TIME} %{DATA:JOB_ID} %{DATA:ENTRY_POINT} %{TIMESTAMP_ISO8601:TIMESTAMP_DERIVED} %{DATA:USERID_DERIVED} %{IP:CLIENT_IP} %{DATA:URI_ID_DERIVED} %{}

```

But your message is:

```auto
QueuedExecution,20210122081531.598,4_lzkE_0xNkvgvX2-pPuc-,00Df2000001Ggxq,005f20000097sks,571,329,SerialBatchApexRangeChunkHandler,,,,164746508,7074O0000BC6XjC,TPM_RefreshProductAndCustomerBatch,2021-01-22T08:15:31.598Z,005f20000097sksAAA,,

```

This does not match, you need to change your dissect mapping and add the commas in your message.

Considering the two first fields.

```auto
QueuedExecution,20210122081531.598

```

Your dissect mapping should be:

```auto
%{event_type},%{time_stamp}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2021, 1:25pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-error/261904/3 "2021-02-19T13:25:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.