How to use Dissect to handle a newline

Elastic Stack Logstash
1

I Just want split a message into two lines, it is a simple case, but i didn't get the result
(according to: https://www.elastic.co/guide/en/logstash/5.6/plugins-filters-dissect.html#plugins-filters-dissect-mapping)
image
and i get the bad result like:

image
image.png915×256 10.8 KB

Too weird

2

'field1' get empty string, while 'description' lost a character 'c' from message.

3

I would have expected to get a _dissectfailure from that. Remove the double quotes from the dissect mapping. They do not appear in the message.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.