# Issector mapping, pattern not found error in Logstash

**URL:** <https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226>\
**Category:** Logstash\
**Created:** [December 16, 2021, 9:29pm UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226 "2021-12-16T21:29:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![arunpmohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunpmohan/32/69467_2.png) [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Post date:** [December 16, 2021, 9:29pm UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226/1 "2021-12-16T21:29:46Z")

</div>

I have an log message which I split using grok and then use an **if** conditional to parse a field using dissect filter. But it is giving me **Dissector mapping, pattern not found error.**  
I tried the dissect pattern with [https://dissect-tester.jorgelbg.me/](https://dissect-tester.jorgelbg.me/) website and it was working fine there. Even for the errored pattern, it was doing fine.

```auto
if 'kafka' not in [tags] {
       grok {
         tag_on_failure => ["windows_message_grok_failed"]
           match => {
             "message" => [
              "(?<[windows][event_id]>[0-9]*)#011(?<unknown_field>[a-zA-Z/s]*)011#011%{GREEDYDATA:event_text}"
             ]
           }
         add_tag => ["windows"]
       }
	   if [windows][event_id] == '4662' {
			dissect {
              id => "dissect_pattern_windows_4662"
              mapping => {
                "event_text" => "%{text->}Subject%{?ignore->}Security ID:%{[subject][security_id]->}Account Name:%{[subject][account_name]->}Account Domain:%{[subject][account_domain]->}Logon ID:%{[subject][logon_id]->}Object:%{?ignore->}Object Server:%{[object][server]->}Object Type:%{[object][object_type]->}Object Name:%{[object][object_name]->}Handle ID:%{[object][handle_id]->}Operation:%{?ignore->}Operation Type:%{[operation][operation_type]->}Accesses:%{[operation][accesses]->}Access Mask:%{[operation][access_mask]->}Properties:%{[operation][properties]->}Additional Information:%{?ignore->}Parameter 1:%{[additional_information][parameter1]->}Parameter 2:%{[additional_information][parameter2]->}#011%{residue_code->}"
              }
              add_tag => ["event_id_parsed","dissect_4662"]
            }
	   }
}	   

```

Also here is one message which i got the above warning. (this works perfectly in the above website and the pattern above)  
This is the text coming under the "event\_text" field which is parsed from the grok filter. And using above website and the dissect filter pattern, i was able to get it working in the website. But in logstash, it returns the " **Dissector mapping, pattern not found error.**"

```auto
An operation was performed on an object. Subject : Security ID: P-7-5-21-1593251271-26251271 Account Name: FIDILIS$ Account Domain: FW-TRA Logon ID: 0x16ACD1E8D Object: Object Server: DS Object Type: %{df232386-0fg5-00d0-a878-53312d5f5926} Object Name: %{233423q5-2fb3-4mac-b2ce-42295d4544423} Handle ID: 0x0 Operation: Operation Type: Object Access Accesses: Read Property Access Mask: 0x10 Properties: Read Property {233423q5-2fb3-4mac-b2ce-42295d4544423} Additional Information: Parameter 1: - Parameter 2: #0111877943017\n

```

Do anyone know what is the cause of such behaviour and how to solve this?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 16, 2021, 10:38pm UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226/2 "2021-12-16T22:38:07Z")

</div>

> [@arunpmohan](#):
>
> Do anyone know what is the cause of such behaviour and how to solve this?

Remove all of the `->` in your patterns. See [this](https://github.com/logstash-plugins/logstash-filter-dissect/issues/71) issue.

```
"%{text->}Subject%{...}

```

does not match

```
"An operation was performed on an object. Subject : 

```

It does match

```
"An operation was performed on an object. SubjectSubject :

```

---

<div class="post-metadata">

**Author:** ![arunpmohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunpmohan/32/69467_2.png) [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Post date:** [December 18, 2021, 1:45am UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226/3 "2021-12-18T01:45:07Z")

</div>

Thank for pointing this out. Worked out to be great.  
Also, I had to update the logger setting with below API for removing the WARN level logs, which clogged my logstash logs.

```auto
curl -XPUT 'localhost:9600/_node/logging?pretty' -H 'Content-Type:
  application/json' -d'
  {
      "logger.org.logstash.dissect.Dissector" : "ERROR"
  }'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2022, 1:45am UTC](https://discuss.elastic.co/t/issector-mapping-pattern-not-found-error-in-logstash/292226/4 "2022-01-15T01:45:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.