# Logstash dissect plugin prase doesn't correct with empty field in content
**URL:** https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992
**Category:** Logstash
**Created:** [October 24, 2017, 4:31am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992 "2017-10-24T04:31:12Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [October 24, 2017, 4:31am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/1 "2017-10-24T04:31:12Z")
@zikakou1er @Allwyn @matslats @Kubson @fcza
I use the dissect plugin with logstash to parse the log which has empty fileds, but is doesn't match fields correctly.The folowing is my log pattern and logstash config file and logstash output:
**log pattern:**
`2017-10-24|||500|`
**logstash config file:**
```auto
input {
beats {
port => 5044
}
}
filter {
ruby {
code => "
event.timestamp.time.localtime
tstamp = event.get('@timestamp').to_i
event.set('date_str', Time.at(tstamp).strftime('%Y-%m-%d'))
"
}
dissect {
mapping => {
"message" => "%{time_local}|%{server_ip}|%{request}|%{status_code}|%{upstrame}"
}
}
}
output {
stdout { codec => rubydebug }
}
```
**logstash parse result:**
```auto
{
"date_str" => "2017-10-23",
"request" => "",
"status_code" => "",
"business" => "nginx",
"offset" => 217,
"input_type" => "log",
"time_local" => "2017-10-24",
"source" => "/home/ec2-user/filebeat/test.log",
"message" => "2017-10-24|||500|",
"type" => "access",
"tags" => [
[0] "beats_input_codec_plain_applied"
],
"@timestamp" => 2017-10-24T04:00:22.130Z,
"@version" => "1",
"beat" => {
"hostname" => "awsuw7-50.opi.com",
"name" => "awsuw7-50.opi.com",
"version" => "5.5.1"
},
"host" => "awsuw7-50.opi.com",
"server_ip" => "500",
"upstrame" => ""
}
```
So, as we have seen, the parse was is not correct, the server\_ip filed should be "", request filed shuld be "", status\_code filed shuld be 500, but the result is not what i want. So, what's the reason, how to fix this problem?
- Version: 5.5.1
- Operating System: CentOs 7
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 24, 2017, 5:16am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/2 "2017-10-24T05:16:20Z")
This looks like a bug. As a workaround use a csv filter instead.
---
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [October 24, 2017, 5:37am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/3 "2017-10-24T05:37:58Z")
Thanks for your reply, 5.5.1 is a relatively new version, i was wondering if there was a problem with my usage method.😀
---
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [October 24, 2017, 5:39am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/4 "2017-10-24T05:39:43Z")
If i use csv filter, could i still write to Elasticsearch?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 24, 2017, 6:17am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/5 "2017-10-24T06:17:04Z")
> If i use csv filter, could i still write to Elasticsearch?
Yes, of course.
---
### Author:  [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)
#### Post date: [November 2, 2017, 8:55am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/6 "2017-11-02T08:55:55Z")
This bug has been fixed in version 1.1.1 of dissect plugin. [GitHub - logstash-plugins/logstash-filter-dissect at v1.1.1](https://github.com/logstash-plugins/logstash-filter-dissect/tree/v1.1.1)
This is change log:[https://github.com/logstash-plugins/logstash-filter-dissect/blob/v1.1.1/CHANGELOG.md](https://github.com/logstash-plugins/logstash-filter-dissect/blob/v1.1.1/CHANGELOG.md)
But:
I just want to install the new version 1.1.1 of dissect, followed the instruction of README.md, but that failed, when i start logstash then it reported ERROR as following:
> [2017-11-01T21:17:18,053][ERROR][logstash.plugins.registry] Problems loading a plugin with {:type=\>"filter", :name=\>"dissect", :path=\>"logstash/filters/dissect", :error\_message=\>"\n\n\tyou might need to reinstall the gem which depends on the missing jar or in case there is Jars.lock then resolve the jars with `lock_jars` command\n\nno such file to load -- org/logstash/dissect/jruby-dissect-library/1.1.1/jruby-dissect-library-1.1.1 (LoadError)", :error\_class=\>RuntimeError, :error\_backtrace=\>["/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar\_dependencies.rb:348:in `do_require'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:255:in `require\_jar'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar\_dependencies.rb:0:in `require_jar_with_block'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/jar-dependencies-0.3.11/lib/jar_dependencies.rb:254:in `require\_jar'", "/home/web/logstash-5.5.1/lib/bootstrap/patches/jar\_dependencies.rb:6:in `require_jar'", "/home/web/logstash-filter-dissect/lib/jruby-dissect-library_jars.rb:4:in `(root)'", "org/jruby/RubyKernel.java:1040:in `require'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'", "/home/web/logstash-filter-dissect/lib/logstash/filters/dissect.rb:1:in `(root)'", "org/jruby/RubyKernel.java:1040:in `require'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'", "/home/web/logstash-filter-dissect/lib/logstash/filters/dissect.rb:6:in `(root)'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/plugins/registry.rb:1:in `(root)'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/plugins/registry.rb:156:in `legacy\_lookup'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/plugins/registry.rb:138:in `lookup'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/plugins/registry.rb:180:in `lookup\_pipeline\_plugin'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/plugin.rb:140:in `lookup'", "org/jruby/RubyKernel.java:1079:in `eval'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:100:in `plugin'", "(eval):37:in `initialize'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:72:in `initialize'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/pipeline.rb:156:in `initialize'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/agent.rb:286:in `create_pipeline'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/agent.rb:95:in `register\_pipeline'", "/home/web/logstash-5.5.1/logstash-core/lib/logstash/runner.rb:314:in `execute'", "/home/web/logstash-5.5.1/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/home/web/logstash-5.5.1/lib/bootstrap/environment.rb:71:in `(root)'"]}
**The following is my installation steps:**
- bin/logstash-plugin remove logstash-filter-dissect
- git clone [GitHub - logstash-plugins/logstash-filter-dissect: Extract structured fields from an unstructured line](https://github.com/logstash-plugins/logstash-filter-dissect.git)
- cd logstash-filter-dissect
- gem build logstash-filter-dissect-1.1.1.gem
- bin/logstash-plugin install --no-verify
- bin/logstah -f config/central
* * *
**Related Information**
- Logstash Version: 5.5.1
- Operating System: CentOS 7
- Part of Gemfile:
> gem "logstash-filter-dissect", :path =\> "/home/web/logstash-filter-dissect"
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2017, 8:56am UTC](https://discuss.elastic.co/t/logstash-dissect-plugin-prase-doesnt-correct-with-empty-field-in-content/104992/7 "2017-11-30T08:56:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.