Filebeat - Dissect Message String

[borna_talebi]

You could use an ingest pipeline and define several dissect processor in it. using ingest pipeline moves the dissect process to elasticsearch rather than filebeat and it's easier to debug your problems with simulate API.

@iccMe

it comes back with "error: empty string provided".

Take look at this. it might help.

@iccMe

Really struggling to dissect it properly, I can get the timestamp, servername dissected, after that I get various results depending on which line of data it is reading.

If you could send me your dissect pattern I might be able to find the problem.

thanks

Borna