Filebeat dissect tokenizer problem

[elastic_dave]

Hi everyone,

having problem with setting up .yml config file and specificaly processors:dissect.

i have root filebeat.yml file pointing to several config files. This seems to work, in filebeat log i can see that config files are loaded.

But than having problem with setting up these config files

#component-config.yml

- type: log
  paths:
    - D:\my\path\to\*\*\component\*\*.log
  processors:
    - dissect:
        tokenizer: "%{1}\\%{2}\\%{3}\\%{4}\\%{env}\\%{region}\\%{component}\\%{5}\\%{logname}.log"
        field: "source"
    - drop_fields:
        fields: [1,2,3,4,5]

  fields:
    app: "my_app"
    es_id: "some_id"
    es_ver: "some_ver"
    correlation_id: "some_c_id"
    type: "beats"
    application: "some_application"
    component: "some_component"
  fields_under_root: true
  multiline.pattern: '^20'
  multiline.negate: true
  multiline.match: after

ERROR : Exiting: the processor dissect doesn't exist

dissect part in the documentation is weak and iam a bit flustrated by that issue allready .

Thanks in advance for any tips

[mtojek (Marcin Tojek)]

Could you please share any information about the filebeat version you're using? What is the exact error you observed?

[elastic_dave]

Version is 6.3.2 and error is as i mentioned above : ERROR : Exiting: the processor dissect doesn't exist , this is the only error i can see in a filebeat.log. When i delete the processors& dissect part i can see that logs are shipped without a problem, but i really need that {env} {region} from path.