# Help with dissect in filter for logstash.conf to dynamically append filename to index patternNotFound Error

**URL:** <https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692>\
**Category:** Logstash\
**Tags:** docker\
**Created:** [May 17, 2023, 7:27pm UTC](https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692 "2023-05-17T19:27:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fsaa](https://avatars.discourse-cdn.com/v4/letter/f/8c91f0/32.png) [@fsaa](https://discuss.elastic.co/u/fsaa)\
**Post date:** [May 17, 2023, 7:27pm UTC](https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692/1 "2023-05-17T19:27:24Z")

</div>

My folder structure is as follows:

```auto
main_directory.
| .env
| docker-compose.yml
|
+---elasticsearch
| \---config
| elasticsearch.yml
|
\---logstash
    +---config
    | | logstash.yml
    | | pipelines.yml
    | |   
    | \---pipeline
    | logstash.conf
    |
    +---data
    | | .lock
    | | dummy.csv
    | | test.csv
    | | uuid
    | |
    | +---dead_letter_queue
    | \---queue
    \---logs

```

My `logstash.conf` is as follows:

```auto
input {
  file {
    path => "/usr/share/logstash/data/*.csv"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

filter {
  csv {
    separator => ","
    # columns => ["User_Id","First_Name"]
    autodetect_column_names => true
    skip_header => true
  }
  dissect{
    mapping => {
      "path" => "/usr/share/logstash/data/#%{file_name}.csv"

    }
  }
}

output {
  elasticsearch {
    hosts => "${ELASTICSEARCH_HOST}"
    user => "${ELASTICSEARCH_USERNAME}"
    password => "${ELASTICSEARCH_PASSWORD}"
    index => "my_index_prime_%{file_name}"
    ssl => true
    ssl_certificate_verification => false
    manage_template => false
  }
}

```

Inside the `/data/` directory there are many csv like `test.csv, sample.csv, work_index_one.csv` etc.

I used `dissect` in filter to add filenames to my index in the format of `my_index_prime_${file_name}` but I got the `patternNotFound` error:

```auto
[2023-05-17T19:38:16,515][WARN][org.logstash.dissect.Dissector][main][3b3f27d0e8ab71d66a5d2b9d3b16693ce141224b733810c11fea3544cb5beef7] Dissector mapping, pattern not found {"field"=>"path", "pattern"=>"/usr/share/logstash/data/#%{file_name}.csv", "event"=>{"tags"=>["_dissectfailure"], "@version"=>"1", "message"=>"002,Asif\r", "path"=>"/usr/share/logstash/data/dummy.csv", "First_Name"=>"Asif", "@timestamp"=>2023-05-17T19:38:16.308Z, "host"=>"f47d5a099289", "User_Id"=>"002"}}

```

Any advice would be highly appreciated!

I'm trying to dynamically append file name to my index

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2023, 10:23pm UTC](https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692/2 "2023-05-17T22:23:30Z")

</div>

Your dissect mapping requires that the filename start with #, but the path field in your event does not contain #, so there is no match.

---

<div class="post-metadata">

**Author:** ![fsaa](https://avatars.discourse-cdn.com/v4/letter/f/8c91f0/32.png) [@fsaa](https://discuss.elastic.co/u/fsaa)\
**Post date:** [May 18, 2023, 1:43am UTC](https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692/3 "2023-05-18T01:43:40Z")

</div>

thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2023, 1:44am UTC](https://discuss.elastic.co/t/help-with-dissect-in-filter-for-logstash-conf-to-dynamically-append-filename-to-index-patternnotfound-error/333692/4 "2023-06-15T01:44:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.