# Filebeat - Dissect Message String

**URL:** https://discuss.elastic.co/t/filebeat-dissect-message-string/251435
**Category:** Beats
**Tags:** filebeat
**Created:** [October 8, 2020, 12:03pm UTC](https://discuss.elastic.co/t/filebeat-dissect-message-string/251435 "2020-10-08T12:03:50Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [October 12, 2020, 11:15am UTC](https://discuss.elastic.co/t/filebeat-dissect-message-string/251435/4 "2020-10-12T11:15:50Z")

</div>

You could use an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) and define several [dissect processor](https://www.elastic.co/guide/en/elasticsearch/reference/master/dissect-processor.html) in it. using ingest pipeline moves the dissect process to elasticsearch rather than filebeat and it's easier to debug your problems with [simulate API](https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html).

> [@iccMe](#):
>
> it comes back with "error: empty string provided".

Take look at [this](https://discuss.elastic.co/t/error-with-dissect-filter-solved/135368). it might help.

> [@iccMe](#):
>
> Really struggling to dissect it properly, I can get the timestamp, servername dissected, after that I get various results depending on which line of data it is reading.

If you could send me your dissect pattern I might be able to find the problem.

thanks

Borna

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-dissect-message-string/251435)._