# Dissector mapping, pattern not found (Jfrog artifactory service logs)

**URL:** <https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305>\
**Category:** Elasticsearch\
**Created:** [March 5, 2021, 12:16am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305 "2021-03-05T00:16:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jchiu](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@jchiu](https://discuss.elastic.co/u/jchiu)\
**Post date:** [March 5, 2021, 12:16am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305/1 "2021-03-05T00:16:57Z")

</div>

Hello all,

I am having a hard time parsing the JFrog's artifactory-service log with "dissect".  
Even after few searches here, I still couldn't figure out what went wrong... Hope that someone could be kind enough to take a look at my filter and point out what I might be missing?

Sample log message:

```auto
2021-03-03T23:10:26.645Z [jfrt] [WARN] [38d999999] [o.a.s.TaskCallback:205] [art-exec-135791] - After execute: Could not locate reactive task with token artifactory.ArtifactCleanupJob#4eaaaaaa-b555-4fff-5555-dd2a22222222

```

And below is my dissect filter:

```auto
    dissect {
      mapping => {
        "message" => "%{datetime} [%{arty_thread_name->}] [%{loglevel->}] [%{?someid->}] [%{arty_event_type->}] [%{?otherid->}] – %{long_msg}"

```

Error message I've been getting:

```auto
[[main]>worker0] Dissector - Dissector mapping, pattern not found

```

I will keep trying different pattern and post my update here if I can figure it out before someone answered this thread 🙂

Also, any good resource for parsing JFrog's artifactory-access/request/service logs are greatly appreciated.

Thank you all in advance!

---

<div class="post-metadata">

**Author:** ![jchiu](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@jchiu](https://discuss.elastic.co/u/jchiu)\
**Post date:** [March 5, 2021, 2:23am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305/2 "2021-03-05T02:23:48Z")

</div>

I gave up on the Dissect, and switched to Grok, this syntax works

```auto
    grok {
      match => {
        "message" => "^%{TIMESTAMP_ISO8601:arty_time} \[%{DATA:arty_thread_name}\] \[%{DATA:loglevel}\] \[%{DATA:someID}\] \[%{DATA:arty_event_type}\] \[%{DATA:otherid}\] \- %{GREEDYDATA:syslog_msg}$"
      }
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2021, 2:24am UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found-jfrog-artifactory-service-logs/266305/3 "2021-04-02T02:24:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.