# How to use processor in Filebeat hint-based auto-discover?

**URL:** <https://discuss.elastic.co/t/how-to-use-processor-in-filebeat-hint-based-auto-discover/223701>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 16, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-use-processor-in-filebeat-hint-based-auto-discover/223701 "2020-03-16T07:05:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jack\_Phan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_phan/32/44738_2.png) [@Jack\_Phan](https://discuss.elastic.co/u/Jack_Phan)\
**Post date:** [March 16, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-use-processor-in-filebeat-hint-based-auto-discover/223701/1 "2020-03-16T07:05:35Z")

</div>

I'm having a log file from my cron-service with the format like this:

> ISO\_time|job\_name|job\_status

Example:

> 2020-03-16T06:30:02+00:00|clean\_up\_database|0  
> 2020-03-16T06:30:03+00:00|random\_job|1

How can I parse those fields with **dissect** processor and **convert** the status\_code at the end to an integer? I updated the annotation of the pod with the following command but it didn't work:

```
kubectl annotate pods <pod_name> co.elastic.logs/enabled=true --overwrite

kubectl annotate pods <pod_name> co.elastic.logs/processors.1.dissect.target_prefix='' --overwrite
kubectl annotate pods <pod_name> co.elastic.logs/processors.1.dissect.tokenizer='%{time}|%{job.name}|%{job.status_code}' --overwrite

kubectl annotate pods <pod_name> co.elastic.logs/processors.2.convert.fields='{from: "job.status_code", type: "integer"}' --overwrite

kubectl annotate pods <pod_name> co.elastic.logs/processors.3.timestamp.field='time' --overwrite
kubectl annotate pods <pod_name> co.elastic.logs/processors.3.timestamp.layouts='2020-03-16T04:05:02.234Z' --overwrite
kubectl annotate pods <pod_name> co.elastic.logs/processors.3.timestamp.test='2020-03-16T04:05:02+00:00' --overwrite

kubectl annotate pods <pod_name> co.elastic.logs/processors.4.drop_fields.fields='time' --overwrite

```

I really appreciate anyone who can help me out 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2020, 7:05am UTC](https://discuss.elastic.co/t/how-to-use-processor-in-filebeat-hint-based-auto-discover/223701/2 "2020-04-13T07:05:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.