# How to determine when dissect fails and branch to try a different dissect clause?

**URL:** https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824
**Category:** Logstash
**Created:** [December 7, 2018, 12:16am UTC](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824 "2018-12-07T00:16:48Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)
#### Post date: [December 13, 2018, 6:48am UTC](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824/4 "2018-12-13T06:48:49Z")

</div>

Hi Russell,

Yes, you are right, they are combined as a single Logstash pipeline. Logstash follows the UNIX way for merging the files and creating a single channel. The issue has been discussed here:

> [@Combining several logstash config files into one... how do you do it?](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546):
>
> To date, we have created several mini-config files on our own to satisfy very specific goals. Now we are looking to consolidate these files on a common server and wondering how to go about it. Is the best practice to combine all config file statements into one-big-file (with a bunch of conditional statements) and run a single instance of LogStash with that one-big-file?! Is there a way to start logstash with a number of config files? Can you run multiple instances of Logstash, each of which…

If you have multiple inputs, it would make sense to probably use the Multiple Pipeline feature in Logstash.

> **[Multiple Pipelines | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html)**

Your issue is mostly with how logstash merges your files. Could you probably follow a pattern similar to this:

```auto
### Input Section ###
10_input_beats.conf
10_input_syslog.conf
### End ###

### Filter Section ###
10_filter_syslog.conf
20_filter_syslog.conf
10_filter_beats.conf
### End ###

### Output Section ###
10_output.conf
### End ### 

```

This will ensure your filters are applied in the correct order and they work.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824)._