# Filebeat processor not doing anything **URL:** \ **Category:** Elasticsearch\ **Created:** [September 12, 2023, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890 "2023-09-12T22:06:34Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Post date:** [September 12, 2023, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/1 "2023-09-12T22:06:35Z")
I'm trying to use a processor to split up syslog messages into separate fields (using the '=' character as a delimiter). Here's my processor: ```auto - type: syslog format: auto protocol.udp: host: "0.0.0.0:9002" tags: ["filebeat-syslog"] processors: - if: equals: input.type: "syslog" then: - dissect: tokenizer: '"%{log.preamble}=%{log.sourceip}"' field: "message" target_prefix: "dissect" ``` Here's an example of a log file that I'm feeding it: ```auto { "_index": ".ds-filebeat-8.9.1-2023.09.11-000009", "_id": "CjBmi4oBzDe7dmnI5VCr", "_version": 1, "_score": 0, "_source": { "@timestamp": "2023-09-12T21:58:02.332Z", "message": "<140>Original Address=[redacted] Sep 12 17:58:02 2023 [redacted]cluster_mgr[4306]: <352310> <4306> <[redacted]> (cm_update_l2_connectivity) Peer [redacted] Connection status L3 Connected, Failed VLAN 814", "log": { "source": { "address": "[redacted]:64187" } }, "tags": [ "syslog" ], "input": { "type": "syslog" }, "agent": { "ephemeral_id": "9047818c-71f4-4b24-9bb0-f58fa609f5af", "id": "998ebe76-3f5e-48e2-9944-e1ba6df5656f", "name": "zeek1", "type": "filebeat", "version": "8.9.1" }, "ecs": { "version": "8.0.0" }, "host": { "mac": [ "18-66-DA-AC-80-07", "18-66-DA-AC-80-08", "18-66-DA-AC-80-09", "18-66-DA-AC-80-0A", "A0-36-9F-F0-EB-24", "A0-36-9F-F0-EB-26", "A0-36-9F-F0-F1-40", "A0-36-9F-F0-F1-42" ], "hostname": "zeek1", "architecture": "x86_64", "os": { "codename": "jammy", "type": "linux", "platform": "ubuntu", "version": "22.04.3 LTS (Jammy Jellyfish)", "family": "debian", "name": "Ubuntu", "kernel": "5.15.0-78-generic" }, "id": "5eb37bd26b0e4ba792a1575c41c3a2db", "containerized": false, "name": "zeek1", "ip": [ "[redacted]", "fe80::1a66:daff:feac:8008", "fe80::1a66:daff:feac:8009", "fe80::a236:9fff:fef0:f140", "fe80::a236:9fff:fef0:f142", "fe80::a236:9fff:fef0:eb26" ] } }, "fields": { "host.os.name.text": [ "Ubuntu" ], "host.hostname": [ "zeek1" ], "host.mac": [ "18-66-DA-AC-80-07", "18-66-DA-AC-80-08", "18-66-DA-AC-80-09", "18-66-DA-AC-80-0A", "A0-36-9F-F0-EB-24", "A0-36-9F-F0-EB-26", "A0-36-9F-F0-F1-40", "A0-36-9F-F0-F1-42" ], "host.ip": [ "[redacted]", "fe80::1a66:daff:feac:8008", "fe80::1a66:daff:feac:8009", "fe80::a236:9fff:fef0:f140", "fe80::a236:9fff:fef0:f142", "fe80::a236:9fff:fef0:eb26" ], "agent.type": [ "filebeat" ], "host.os.version": [ "22.04.3 LTS (Jammy Jellyfish)" ], "host.os.kernel": [ "5.15.0-78-generic" ], "host.os.name": [ "Ubuntu" ], "agent.name": [ "zeek1" ], "host.name": [ "zeek1" ], "host.id": [ "5eb37bd26b0e4ba792a1575c41c3a2db" ], "host.os.type": [ "linux" ], "host.os.codename": [ "jammy" ], "input.type": [ "syslog" ], "agent.hostname": [ "zeek1" ], "message": [ "<140>Original Address=[redacted] Sep 12 17:58:02 2023 [redacted] cluster_mgr[4306]: <352310> <4306> <[redacted]> (cm_update_l2_connectivity) Peer [redacted] Connection status L3 Connected, Failed VLAN 814" ], "tags": [ "filebeat-syslog" ], "host.architecture": [ "x86_64" ], "@timestamp": [ "2023-09-12T21:58:02.332Z" ], "agent.id": [ "998ebe76-3f5e-48e2-9944-e1ba6df5656f" ], "ecs.version": [ "8.0.0" ], "host.containerized": [ false ], "host.os.platform": [ "ubuntu" ], "log.source.address": [ "[redacted]:64187" ], "agent.ephemeral_id": [ "9047818c-71f4-4b24-9bb0-f58fa609f5af" ], "agent.version": [ "8.9.1" ], "host.os.family": [ "debian" ] } } ``` However, the log remains unchanged... ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 12, 2023, 10:30pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/2 "2023-09-12T22:30:40Z")
Hi @artschooldropout > [@artschooldropout](#): > > ```auto > - if: > equals: > input.type: "syslog" > then: > > ``` Curious why you are putting the `if` in there instead of just the `dissect` since that will only be applied to this input (this is an input specific process not a global processor ```auto - type: syslog format: auto protocol.udp: host: "0.0.0.0:9002" tags: ["filebeat-syslog"] processors: - dissect: tokenizer: '"%{log.preamble}=%{log.sourceip}"' field: "message" target_prefix: "dissect" ``` ---
**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Post date:** [September 12, 2023, 10:47pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/3 "2023-09-12T22:47:47Z")
Aha - ok, that's my misunderstanding. I tried as you suggested, and I get a somewhat ambiguous flag: ```auto log.flags dissect_parsing_error ``` ---
**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Post date:** [September 12, 2023, 10:50pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/4 "2023-09-12T22:50:04Z")
By the way, I tried this fun little 'Dissect tester' site: [Test Tokenizer Patterns for the Dissect filter](https://dissect-tester.jorgelbg.me/) The site shows a nicely tokenized output: ```auto { "syslog.preamble": "<140>Original Address", "syslog.sourceip": "[redacted] Sep 12 17:49:48 2023 [redacted] cluster_mgr[4306]: <352310> <4306> (cm_update_l2_connectivity) Peer [redacted] Connection status L3 Connected, Failed VLAN 814" } ``` ---
**Author:** ![artschooldropout](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Post date:** [September 12, 2023, 11:11pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/5 "2023-09-12T23:11:49Z")
Aha - I had extra single quotation marks around my dissector. It should have been: ```auto tokenizer: "%{log.preamble}=%{log.sourceip}" ``` Thanks again @stephenb for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 10, 2023, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-processor-not-doing-anything/342890/6 "2023-10-10T23:12:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.