Does Dissect's mapping able to match multiple pattern?

[Muhammad_Ariful_Isla (Muhammad Ariful Islam)]

As my log have multiple pattern I need to use multiple dissect pattern so that if one pattern fails to recognize the log other can capture. Following pseudo configuration works,

"message" => "pattern1"

Or

"message" => "pattern2"

But following configuration is not working,

"message" => ["pattern1", "pattern2"]

Does dissect support these kinds of match?

I saw something like this on @Christian_Dahlqvist’s answer on the following link,

Add support for multiple dissect patterns on a field like Grok

Especially in the following part,

dissect {
 break_on_match => true
 mapping => {
   "message" => [
     "%{ts->} %{+ts} %{+ts} %{host} %{command}(pam_unix)[%{pid}]: %{action} %{+action} for user %{user} by (uid=%{uid})%{}",
     "%{ts->} %{+ts} %{+ts} %{host} %{command}(pam_unix)[%{pid}]: %{action} %{+action} for user %{user}",
     "%{ts->} %{+ts} %{+ts} %{host} %{command}(pam_unix)[%{pid}]: %{action} %{+action}; %{params}"
 }
}

[Badger]

@Muhammad_Ariful_Isla

Does dissect support these kinds of match?

No, it does not. The issue you linked to is a suggestion for a possible modification to the design of the filter, it has not been implemented.