# Help with 'dissect\_parsing\_error' on 'log file path'

**URL:** <https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 2, 2020, 10:03am UTC](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451 "2020-08-02T10:03:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yirmio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yirmio/32/73191_2.png) [@Yirmio](https://discuss.elastic.co/u/Yirmio)\
**Post date:** [August 2, 2020, 10:03am UTC](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451/1 "2020-08-02T10:03:43Z")

</div>

Hi

I'm collecting logs from a central location, where each machine keep the log in separate folder,  
each folder name represents the machine name.

In Filebeat, I want to put the folder name as field 'HOSTNAME', below is the processors part in the config file:

```auto
    processors:
      - add_host_metadata: ~    
      - add_locale:
          format: abbreviation
      - add_fields:
          fields:        
            config_file_ver: "0.6"
      - if:
          regexp: 
            log.file.path: "^.*OSDLogs\\.*"
        then:
          - dissect:
              tokenizer: '^.*OSDLogs\\%{HOSTNAME}\\.*'
              field: "log.file.path"          
        else:
          - copy_fields:
              fields:
              - from: "agent.hostname"
                to: "HOSTNAME"

```

file path example:

> \servername\public$\OSDLogs\host123\host123-181316.log

All docs get's the following tags:

> log.flags dissect\_parsing\_error  
> tags \_grokparsefailure

How can i solve it?

Thanks!

---

<div class="post-metadata">

**Author:** ![Yirmio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yirmio/32/73191_2.png) [@Yirmio](https://discuss.elastic.co/u/Yirmio)\
**Post date:** [August 2, 2020, 2:21pm UTC](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451/2 "2020-08-02T14:21:17Z")

</div>

in debug log i get this message:

could not find beginning delimiter: `\\\\servername\\public$\\` in remaining: `\\servername\public$\OSDLogs\6044234POOLBWS\6044234POOLBWS.log`, (offset: 0)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2020, 4:21pm UTC](https://discuss.elastic.co/t/help-with-dissect-parsing-error-on-log-file-path/243451/3 "2020-08-30T16:21:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.