# Error with dissect filter \[SOLVED\]
**URL:** https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368
**Category:** Logstash
**Created:** [June 11, 2018, 1:20pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368 "2018-06-11T13:20:27Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 1:20pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/1 "2018-06-11T13:20:28Z")
I am trying to parse this message:
```
Summary for local -------------- Succeeded: 478 (changed=180) Failed: 0 -------------- Total states run: 478 Total run time: 68.410 s [Tue, 05 Jun 2018 14:33:17 +0200] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service. The system is finally up, after 144.81 seconds
```
As [the grok filter for some reason is unable to parse the message](https://discuss.elastic.co/t/grok-pattern-fails-although-it-is-valid/135317), I'm trying the dissect filter:
```
filter {
dissect {
mapping => { "message" => "Summary for local -------------- Succeeded: %{states_succeeded} (changed=%{states_changed}) Failed: %{states_failed} -------------- \
Total states run: %{states_run} Total run time: %{run_time} s [%{agent_timestamp}] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service \
to /usr/lib/systemd/system/codedeploy-agent.service. The system is finally up, after %{cloudinit_time} seconds" }
}
}
```
This filter results in the assignment of the following indexes:
- **states\_succeeded** : 478
- **states\_failed** : _(empty string)_
- **states\_changed** : _(empty string)_
- **states\_run** : _(empty string)_
- **run\_time** : _(empty string)_
- **cloudinit\_time** : 180) Failed: 0 -------------- Total states run: 478 Total run time: 68.410 s [Tue, 05 Jun 2018 14:33:17 +0200] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service.
The system is finally up, after 144.81 seconds
The only correctly parsed index is "states\_succeeded". Why is it so? It looks like the parentheses are confusing the dissect parser, but escaping them produces other errors.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 1:36pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/2 "2018-06-11T13:36:13Z")
> [@dr01](#):
>
> Summary for local -------------- Succeeded: %{states\_succeeded} (changed=%{states\_changed}) Failed: %{states\_failed} -------------- \ Total states run: %{states\_run} Total run time: %{run\_time} s [%{agent\_timestamp}] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service \ to /usr/lib/systemd/system/codedeploy-agent.service. The system is finally up, after %{cloudinit\_time} seconds" }
Do not use backslash-newline inside the mapping. Just use a single very long line. Once you do that everything parses OK except
```
"cloudinit_time" => "144.81 seconds"
```
and you can fix that with a trailing %{}.
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 1:47pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/3 "2018-06-11T13:47:54Z")
I have removed all backslash-newlines and I get exactly the same result. Does it work on your machine?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 1:49pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/4 "2018-06-11T13:49:36Z")
Yes, with 6.2.4 on Linux it works.
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 1:53pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/5 "2018-06-11T13:53:57Z")
I have exactly the same version and OS (v6.2.4 on Linux CentOS 7.5), and it is causing me endless headaches. Is there something else I should check? Here's my multiline config for Filebeat `/etc/filebeat/filebeat.yml`:
```
filebeat.prospectors:
- type: log
paths:
- /opt/elktest/cloud-init-output.log
multiline:
pattern: '^Summary for local$'
negate: 'true'
match: 'after'
output.logstash:
hosts: ["localhost:5044"]
```
Here's my Logstash config `/etc/logstash/logstash.yml`:
```
path.data: /var/lib/logstash
path.logs: /var/log/logstash
```
And here's my Elasticsearch config `/etc/elasticsearch/elasticsearch.yml`:
```
cluster.name: mycluster
node.name: es01
node.data: true
node.master: true
http.cors.enabled: true
http.cors.allow-origin: "*"
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
```
There's apparently something very wrong with my configuration, since all filter plugins (grok, dissect, ...) are showing unexpected behavior.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 2:03pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/6 "2018-06-11T14:03:36Z")
You have a multiline in filebeat? So your input will have embedded newlines. Your filter patterns need to match that. With no filters, what do you get from output { stdout { codec =\> rubydebug } } ?
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 2:19pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/7 "2018-06-11T14:19:16Z")
Here's the relevant block. How do I match the newlines in the filter?
```
2018-06-11T16:18:10.733+0200 DEBUG [publish] pipeline/processor.go:275 Publish event: {
"@timestamp": "2018-06-11T14:18:05.732Z",
"@metadata": {
"beat": "filebeat",
"type": "doc",
"version": "6.2.4"
},
"source": "/opt/elktest/cloud-init-output.log",
"offset": 396,
"message": "Summary for local\n--------------\nSucceeded: 478 (changed=180)\nFailed: 0\n--------------\nTotal states run: 478\nTotal run time: 68.410 s\n[Tue, 05 Jun 2018 14:33:17 +0200] codedeploy-agent started\nCreated symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service.\nThe system is finally up, after 144.81 seconds",
"prospector": {
"type": "log"
},
"beat": {
"version": "6.2.4",
"name": "centos7",
"hostname": "centos7"
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 11, 2018, 2:33pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/8 "2018-06-11T14:33:18Z")
Use a multiline mapping
```auto
dissect {
mapping => {
"message" => "Summary for local
--------------
Succeeded: %{states_succeeded} (changed=%{states_changed})
Failed: %{states_failed}
--------------
Total states run: %{states_run}
Total run time: %{run_time} s
[%{agent_timestamp}] codedeploy-agent started
Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service.
The system is finally up, after %{cloudinit_time} seconds%{}"
}
}
```
---
### Author:  [@dr01](https://discuss.elastic.co/u/dr01)
#### Post date: [June 11, 2018, 2:33pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/9 "2018-06-11T14:33:41Z")
Thanks for your answer. I solved it differently -- I've added a mutate filter to replace newlines with spaces, and it works at last. Thank you very much.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 9, 2018, 2:33pm UTC](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368/10 "2018-07-09T14:33:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.