# How to match more formats by dissect

**URL:** <https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463>\
**Category:** Logstash\
**Created:** [March 25, 2018, 4:12am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463 "2018-03-25T04:12:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sunil\_Villuri](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)\
**Post date:** [March 25, 2018, 4:12am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463/1 "2018-03-25T04:12:07Z")

</div>

Hi All,

i am having different log formats and i matched one log format by using the dissect combination.

dissect {  
mapping =\> {  
"message" =\> "%{timestamp}|%{component}|%{LogUtils}|%{javaclass}|%{method}|%{delestlog}|%{message\_log}|responseTime:%{responsetime}"  
}  
}

**matched Log:**  
2018-04-10 14:28:07,532|sample-backend|com.example.commerce.backend.utils.LogUtils|com.example.commerce.backend.utils.LogUtils.elastic.CacheCarrierDeliveryEstimatesSearchRepository|indexData()|DELEST\_LOG\_MSG|RESPONSE\_TIME\_FROM\_ELASTIC\_INDEX\_DATA|responseTime:8

**Need to match for this log :**

2018-03-10 14:28:06,182|sample-log|com.example.commerce.backend.utils.LogUtils|com.example.commerce.backend.utils.LogUtils.DeliveryEstimateBusinsessServiceImpl|checkDeliveryEstimates()|DELEST\_LOG\_MSG|INV\_ACTIVE\_LOCATIONS|tenantId:fe84657fcd434f0c8eda7eef0afb0dee|internalRequestUUID:3a14fdf9-fee6-4090-8c02-86b57471fc9d|webId:16500|activeLocationIds:[DC-DC\_198, DC-DC\_396, DC-DC\_600, DC-DC\_810]

2018-03-10 14:28:06,189|sample-log|com.example.commerce.backend.utils.LogUtils|com.example.commerce.backend.utils.LogUtils.UPSConnector|checkDeliveryEstimates()|DELEST\_LOG\_MSG|DELREQ\_TO\_CARRIER|tenantId:fe84657fcd434f0c8eda7eef0afb0dee|internalRequestUUID:3a14fdf9-fee6-4090-8c02-86b57471fc9d|webId:16500|buyerZipCode:01801|shipperZipCode:30517|carrierName:UPS|request:UPSRequest [upsSecurity=UPSSecurity [usernameToken=UsernameToken [username=_ **@gmail.com, password=** _], serviceAccessToken=ServiceAccessToken [accessLicenseNumber=4D29D430C597E41E]], rateRequest=RateRequest [Request=Request [requestOption=shoptimeintransit, transactionReference=TransactionReference [customerContext=commerce]], shipment=Shipment [deliveryTimeInformation=DeliveryTimeInformation [packageBillType=07, pickup=Pickup [date=20180310, time=1830]], shipper=Shipper [name=commerce, shipperNumber=7V4665, address=Address [postalCode=30517, countryCode=US]], shipTo=ShipTo [name=, address=Address [postalCode=01801, countryCode=US]], shipFrom=ShipFrom [address=Address [postalCode=30517, countryCode=US]], service=Service [code=1DA, description=UPS Next Day Air], pack=[Package [packagingType=PackagingType [code=02, description=Package], dimensions=Dimensions [length=10.0, width=10.0, height=10.0, unitOfMeasurement=UnitOfMeasurement [code=IN, description=Inches]], packageWeight=PackageWeight [unitOfMeasurement=UnitOfMeasurement [code=LBS, description=pounds], weight=20.0]]]]]]

**can i extend the exisitng patterns to match to this logs ??**

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 25, 2018, 6:08am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463/2 "2018-03-25T06:08:27Z")

</div>

As all the logs seem to start with the same fields, use dissect to capture these and store the remaining log data in a single field. You can then use conditionals based on the already extracted fields to select the best way to parse the rest of the data using appropriate combinations of filters.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 25, 2018, 7:58am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463/4 "2018-03-25T07:58:29Z")

</div>

I do not have time to create a full working config for you, but try breaking up the processing into steps like this (I have not tested this):

```auto
dissect {
  mapping => {
    "message" => "%{timestamp}|%{component}|%{LogUtils}|%{javaclass}|%{method}|%{delestlog}|%{message_log}|%{recordtype}|%{rest}"
  }
}

if [recordtype] == "RESPONSE_TIME_FROM_ELASTIC_INDEX_DATA" or [recordtype] == "INV_ACTIVE_LOCATIONS" {
  kv {
    field_split => "|"
    value_split => ":"
  }
} else if [recordtype] == "DELREQ_TO_CARRIER" {
  ...
} else {
  ...
}

```

---

<div class="post-metadata">

**Author:** ![Sunil\_Villuri](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@Sunil\_Villuri](https://discuss.elastic.co/u/Sunil_Villuri)\
**Post date:** [March 25, 2018, 10:28am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463/5 "2018-03-25T10:28:37Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> else if [recordtype] == "DELREQ\_TO\_CARRIER" {  
> ...  
> } else {  
> ...  
> }

Thanks for the Reply. i will try the possibility

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2018, 10:28am UTC](https://discuss.elastic.co/t/how-to-match-more-formats-by-dissect/125463/6 "2018-04-22T10:28:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.