# Filebeat dissect tokenizer problem

Hi everyone,

having problem with setting up .yml config file and specificaly processors:dissect.

i have root filebeat.yml file pointing to several config files. This seems to work, in filebeat log i can see that config files are loaded.

But than having problem with setting up these config files

#component-config.yml

- type: log
paths:
- D:\my\path\to\*\*\component\*\*.log
processors:
- dissect:
tokenizer: "%{1}\\%{2}\\%{3}\\%{4}\\%{env}\\%{region}\\%{component}\\%{5}\\%{logname}.log"
field: "source"
- drop_fields:
fields: [1,2,3,4,5]

fields:
app: "my_app"
es_id: "some_id"
es_ver: "some_ver"
correlation_id: "some_c_id"
type: "beats"
application: "some_application"
component: "some_component"
fields_under_root: true
multiline.pattern: '^20'
multiline.negate: true
multiline.match: after


ERROR : Exiting: the processor dissect doesn't exist

dissect part in the documentation is weak and iam a bit flustrated by that issue allready .

Thanks in advance for any tips

Could you please share any information about the filebeat version you're using? What is the exact error you observed?

Version is 6.3.2 and error is as i mentioned above : ERROR : Exiting: the processor dissect doesn't exist , this is the only error i can see in a filebeat.log. When i delete the processors& dissect part i can see that logs are shipped without a problem, but i really need that {env} {region} from path.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.