# Dissector mapping, pattern not found

**URL:** <https://discuss.elastic.co/t/dissector-mapping-pattern-not-found/186509>\
**Category:** Logstash\
**Created:** [June 19, 2019, 3:27pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found/186509 "2019-06-19T15:27:32Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 19, 2019, 3:51pm UTC](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found/186509/2 "2019-06-19T15:51:31Z")

</div>

> [@wasder](#):
>
> My best guess that it is something with char escaping or newline symbol

Correct! Try

```
    dissect { mapping => { "message" => '%{dateTime} %{+dateTime} %{} Host:"%{host}" Zone:"%{zone}" "%{adapter}" "%{process}" %{process_id} %{header}
%{?content}' } }

```

That is, use single quotes around the pattern so that you do not have to escape the double quotes, and use a literal newline in the pattern string.

---

_[View the full topic](https://discuss.elastic.co/t/dissector-mapping-pattern-not-found/186509)._