# File beat version 6.8.13, not parsing ngnix logs from docker container using dissect processor

**URL:** https://discuss.elastic.co/t/file-beat-version-6-8-13-not-parsing-ngnix-logs-from-docker-container-using-dissect-processor/265114
**Category:** Beats
**Tags:** filebeat
**Created:** [February 22, 2021, 7:11pm UTC](https://discuss.elastic.co/t/file-beat-version-6-8-13-not-parsing-ngnix-logs-from-docker-container-using-dissect-processor/265114 "2021-02-22T19:11:05Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![sainumpud](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@sainumpud](https://discuss.elastic.co/u/sainumpud)
#### Post date: [February 22, 2021, 7:11pm UTC](https://discuss.elastic.co/t/file-beat-version-6-8-13-not-parsing-ngnix-logs-from-docker-container-using-dissect-processor/265114/1 "2021-02-22T19:11:05Z")

</div>

Hi,

File beat version 6.8.13 running on VM, I am trying to parse this ngnix container log into separate fields for reporting on unique clientIP address and browser details to show reports on Kibana.

I added dissect processors in filebeat.yml to token each and every detail in ngnix log which is not showing any changes in my Kibana.

I am seeing "message" attribure or fields with complete ngnix log and is not showing as separate fields, no parsing or tokenizing is happen. Any one have any inputs will be appreciated  
**Archictecture:**  
EC2--\> filebeat--\>kafka topic--\>logstash pipline --\> Elasticsearch

```auto
{"log":"[22/Feb/2021:18:59:51 +0000] nginx:29 10.35.96.46 \"GET /management/health HTTP/1.1\" 200 0 \"-\" \"ELB-HealthChecker/2.0\" \"10.30.70.221\"\n","stream":"stdout","attrs":{"tag":"service=dpeu-dev-dpeu-nginx cluster=dpeu-dev application=dpeu full-imagename=937049000706.dkr.ecr.eu-west-1.amazonaws.com/dpeu/dpeu-nginx:133 container-id=61e6e220e73d full-container-id=61e6e220e73d14b4a9f6c6e8bfa3321c5600817838fe211c5426add29bfda653 log_format=nginx "},"time":"2021-02-22T18:59:51.165741872Z"}

```

# Ngnix container log : just log part

```auto
[10/Feb/2021:22:02:32 +0000] nginx:27 10.35.96.46 "GET /sites/default/files/media-icons/default/application-octet-stream.png HTTP/1.1" 200 1520 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.0 Safari/537.36 PTST/1.0" "40.119.52.126, 10.30.69.230, 10.30.70.221"

```

```auto
filebeat.yml
==============
filebeat.inputs:
  - enabled: true
    fields:
      cluster: dpeu-dev
      log_topic: filebeat-json
    paths:
      - /var/lib/docker/containers/*/*-json.log
    processors:
      - dissect:
          when:
            contains:
              log_format: "nginx"
          tokenizer: "[%{@timestamp}] %{*server}:%{&server} %{lbip} \"%{method} %{request} HTTP/%{httpversion}\" %{status} %{bytes} \"%{url}\" \"%{browser}\" \"%{clientip} %{ip1} %{ip2}\""
          field: message
          target_prefix: "nginx"
 
          
    seek: cursor
    type: log

```

```auto
![kibana_log_message|690x104](upload://tH3faTr9GO88moQoRubq5faB4oX.png) 

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 22, 2021, 9:11pm UTC](https://discuss.elastic.co/t/file-beat-version-6-8-13-not-parsing-ngnix-logs-from-docker-container-using-dissect-processor/265114/2 "2021-03-22T21:11:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.