# Dissector mapping, pattern not found in Logstash

**URL:** <https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444>\
**Category:** Logstash\
**Created:** [January 18, 2021, 3:36pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444 "2021-01-18T15:36:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [January 18, 2021, 3:36pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/1 "2021-01-18T15:36:27Z")

</div>

Hi Team,

I am getting Dissector mapping, pattern not found in Logstash while start logstash.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 18, 2021, 5:58pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/2 "2021-01-18T17:58:57Z")

</div>

What does your dissect filter configuration look like? What does the field you are dissecting look like if you use

```
output { stdout { codec => rubydebug } }
```

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [January 18, 2021, 11:19pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/3 "2021-01-18T23:19:22Z")

</div>

Hi @Badger,

Thanks for your reply.  
Please find the below pattern, Earlier it was working fine . When I have added new fields" RequestType". It starts giving an error.

dissect  
{  
mapping =\> {"message"=\>'%{DATETIME}| %{LOGLEVEL} |%{LOGSOURCE} |%{Id} %{Name} |%{JobId} |%{Type}|  
%{RequestType} |%{LOGMESSAGE}' }  
}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 18, 2021, 11:24pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/4 "2021-01-18T23:24:01Z")

</div>

Please show an example of the [message] field.

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [January 19, 2021, 5:45am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/5 "2021-01-19T05:45:42Z")

</div>

Hi @Badger ,

```auto
Please find the below message, which we are trying to filter in logstash:`
`2021-01-19 08:54:37.8399|DEBUG|BulkUpdate|46497||1514||||Entering in JobTask:1514 to the Job Status:3 for the Id:46497.`
`2021-01-18:54:37.9185|DEBUG|BulkUpdate|46497|Name|1514|Multimedia|
Activate|100052270|Taking Lock Object on the ID while doing the Bulk Activate:1000052270.
`
Please find the logstash config file below:
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}
filter {
   mutate {
			add_field => { "[@metadata][index]" => "%{[fields][type]}" }
		 }    	
  if [@metadata][index] == "log"{ 
dissect { mapping => { "message"=> '%{DATETIME} |%{LOGLEVEL} |%{LOGSOURCE} |%{Id} |%{Name} |%{JobId} |%{ObjectType} 
|%{RequestType}|%{ContentId} |%{LOGMESSAGE}' } }
		}
	else
	{
			dissect { mapping => { "message" => "%{DATETIME}|%{LOGLEVEL}|%{LOGSOURCE}|%{LOGMESSAGE}" } }
	}	
	}
output {
 
	elasticsearch {

		hosts => ["https://x.x.x.x:9200"]	
		user => "elastic"
		password => "xxxxxxx"
		index => "%{[@metadata][index]}-%{+YYYY.MM.dd}"
		ssl => true		
		cacert => "C:\Logstash\logstash-7.7.1\config\ca_logstash.cer"
		ssl_certificate_verification => false
		manage_template => false
     
    }
	
	}

Below are the error which we are getting from logstash:
[2021-01-19T06:17:55,405][WARN][org.logstash.dissect.Dissector][main][e403b63e1abf9a7775c97a93d177eeea4cd151e974911b37e5599183d6f6dfd0] Dissector mapping, pattern not found {"field"=>"message", "pattern"=>"%{DATETIME} |%{LOGLEVEL} |%{LOGSOURCE} |%{Id} |%{Name} |%{JobId} |%{ObjectType} \r\n|%{RequestType}|%{ContentId} |%{LOGMESSAGE}", "
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 19, 2021, 4:39pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/6 "2021-01-19T16:39:19Z")

</div>

> [@Sharma3007](#):
>
> ```auto
> dissect { mapping => { "message"=> '%{DATETIME} |%{LOGLEVEL} |%{LOGSOURCE} |%{Id} |%{Name} |%{JobId} |%{ObjectType} 
> |%{RequestType}|%{ContentId} |%{LOGMESSAGE}' } }
> 
> ```

If you have a dissect pattern like `%{DATETIME} |` with a space before the pipe, then the message field must also have a space before the pipe, and your events do not have that. Try

```
    dissect { mapping => { "message"=> '%{DATETIME}|%{LOGLEVEL}|%{LOGSOURCE}|%{Id}|%{Name}|%{JobId}|%{ObjectType}|%{RequestType}|%{ContentId}|%{LOGMESSAGE}' } }

```

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [January 20, 2021, 4:53am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/7 "2021-01-20T04:53:00Z")

</div>

Hi @Badger,  
I am using the above pattern, but still I am getting the same error  
[2021-01-20T04:50:43,232][WARN][org.logstash.dissect.Dissector][main][fbd05f1f288405b7f74052f29a87e8f57e7878c7621ba1b97ec752e58c8b1053] Dissector mapping, pattern not found {"field"=\>"message", "pattern"=\>"%{DATETIME}|%{LOGLEVEL}|%{LOGSOURCE}|%{Id}|%{Name}|%{JobId}|%{ObjectType}|%{RequestType}|%{ContentId}|%{LOGMESSAGE}",

Please find my observation below:  
If I am using below pattern its working fine.  
dissect { mapping =\> { "message" =\> "%{DATETIME}|%{LOGLEVEL}|%{LOGSOURCE}|%{Id}|%{Name}|%{JobId}|%{ObjectType}|%{LOGMESSAGE}" } }

If I am using below Pattern after adding "ContentId" field its not working & giving me the above error  
dissect { mapping =\> { "message" =\> "%{DATETIME}|%{LOGLEVEL}|%{LOGSOURCE}|%{Id}|%{Name}|%{JobId}|%{ObjectType}|%{ContentId}|%{LOGMESSAGE}" } }

---

<div class="post-metadata">

**Author:** ![Sharma3007](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sharma3007/32/43414_2.png) [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\
**Post date:** [January 20, 2021, 12:29pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/8 "2021-01-20T12:29:32Z")

</div>

Its Resolved.

Thanks @Badger, for your help.Its log message fields mistake .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2021, 12:29pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-in-logstash/261444/9 "2021-02-17T12:29:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.