# Filebeat dissect processor does nothing

**URL:** https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438
**Category:** Beats
**Tags:** filebeat
**Created:** [May 30, 2021, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438 "2021-05-30T15:52:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![IvanovOleg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ivanovoleg/32/89473_2.png) [@IvanovOleg](https://discuss.elastic.co/u/IvanovOleg)
#### Post date: [May 30, 2021, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438/1 "2021-05-30T15:52:11Z")

</div>

Hello. I want to parse logs from the java app running in the kubernetes pod. I have a filebeat configuration like this:

```auto
filebeat.autodiscover:
  providers:
    - type: kubernetes
      templates:
        - condition.or:
            - equals.kubernetes.labels.app: my-app
          config:
            - type: container
              paths:
                - /var/log/containers/*-${data.kubernetes.container.id}.log
              ignore_decoding_error: false
              symlinks: true
      processors:
        - dissect:
            tokenizer: '%{} %{} %{log.level} %{log.logger} - %{log.origin.function} %{log.original}'
            field: "message"
            target_prefix: ""

processors:
  - add_host_metadata:
  - add_kubernetes_metadata:
      host: ${NODE_NAME}
      matchers:
      - logs_path:
          logs_path: "/var/log/containers/"
  - rename:
      ignore_missing: true
      fields:
        - from: "file"
          to: "file.name"

output.elasticsearch:
  host: '${NODE_NAME}'
  hosts: '${ELASTICSEARCH_HOSTS:elasticsearch-master:9200}'

setup.ilm:
  enabled: false
  overwrite: true
  rollover_alias: "filebeat"
  pattern: "{now/M{yyyy.MM}}-000001"
  policy_file: /usr/share/filebeat/ilm.json

setup.template.name: "filebeat"
setup.template.pattern: "filebeat-*"

```

Example log message:  
_2021-05-30 15:20:38 DEBUG c.t.s.a.AkkaSSLConfig - [AkkaSSLConfig(akka://main)] Initializing AkkaSSLConfig extension..._  
Dissect pattern tester shows correct fields, but in Kibana I see only original message with no extra fields. No errors in the filebeat log.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 27, 2021, 5:52pm UTC](https://discuss.elastic.co/t/filebeat-dissect-processor-does-nothing/274438/2 "2021-06-27T17:52:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
