# Logstash is not breaking the logs

**URL:** <https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341>\
**Category:** Logstash\
**Created:** [October 7, 2018, 9:29am UTC](https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341 "2018-10-07T09:29:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shruti51](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@shruti51](https://discuss.elastic.co/u/shruti51)\
**Post date:** [October 7, 2018, 9:29am UTC](https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341/1 "2018-10-07T09:29:13Z")

</div>

Hi,

Logstash is not breaking the logs It is throwing the error:

[2018-10-07T13:57:46,327][WARN][org.logstash.dissect.Dissector] Dissector mapping, pattern not found {"field"=\>"message  
", "pattern"=\>"%{Timestamp} ##%{HostName}##%{Service\_Name}##%{RICEF}

Please help.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [October 7, 2018, 4:44pm UTC](https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341/2 "2018-10-07T16:44:49Z")

</div>

Please show the configuration that resulted in this error.

---

<div class="post-metadata">

**Author:** ![shruti51](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@shruti51](https://discuss.elastic.co/u/shruti51)\
**Post date:** [October 8, 2018, 11:50am UTC](https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341/3 "2018-10-08T11:50:57Z")

</div>

HI Christian,

Please find the config file.  
input {  
beats {  
port =\> 5044  
}  
}

# The filter part of this file is commented out to indicate that it is

# optional.

filter {

```
	if [fields][log_type] == "SP-SAG" {
	if "JMS Message In" in [message] {
		dissect {
			mapping => { 
				message => "%{Timestamp} ##%{HostName}##%{Service_Name}##%{RICEF}##%{Filler1}##%{Correlation_Id}##%{Filler2}##%Service Started : %{StartServiceMessage}##%{Filler3}##%{Filler4}##%{Filler5}##%{Filler6}##%{ServiceContextId}##%{UserName}##%{Filler7}##JMS Message In : %{sourcexmlfile}" }
		}
		xml {
			source => "sourcexmlfile"
			store_xml => false
			xpath => ["/ZWP_PLU03/IDOC/EDI_DC40/DOCNUM/text()", "idoc_no"]
			xpath => ["/ZWP_PLU03/IDOC/E1WPA01[@SEGMENT='1']/FILIALE/text()", "store_no"]
		}
		mutate { 
			remove_field => ["sourcexmlfile"]
		}
	}
	if "TARGET MESSAGEJMS Message Out" in [message] {
		dissect {
			mapping => { 
				message => "%{Timestamp} ##%{HostName}##%{Service_Name}##%{RICEF}##%{IDOC}##%{Correlation_Id}##%{Filler1}##%END SERVICE MESSAGE - SERVICE NAME : %{EndServiceMessage}##%{Filler2}##%{Filler3}##%{Filler4}##%{Filler5}##%{ServiceContextId}##%{UserName}##%{Filler6}##TARGET MESSAGEJMS Message Out : %{targetxmlfile}" }
		}
		xml {
			source => "targetxmlfile"
			store_xml => false
			xpath => ["/FILE/@batchNo", "target_idoc_no"]
			xpath => ["/FILE/TRANSACTION/PRICE/PRICES/PRODUCT_PRICE/@price_band", "store_no"]
		}
		mutate { 
			remove_field => ["targetxmlfile"]
		}
	}
	if "Validation is success" in [message] {
		dissect {
			mapping => { 
				message => "%{Timestamp} ##%{HostName}##%{Service_Name}##%{RICEF}##%{IDOC}##%{Correlation_Id}##%{Filler1}##%{SourceValidationMessage}##%{Filler2}##%{Filler3}##%{Filler4}##%{Filler5}##%{ServiceContextId}##%{UserName}##%{Filler6}##%{Filler7}" }
		}
					
	
	if "##ERROR CODE" in [message] {
		dissect {
			mapping => {
				message => "%{Timestamp} ##%{HostName}##%{Service_Name}##%{RICEF}##%{IDOC}##%{Correlation_Id}##%{Filler1}##END SERVICE MESSAGE - SERVICE NAME : %{EndServiceMessage}##%{Filler2}##%{Filler3}##%{Filler4}##%{Filler5}##%{ServiceContextId}##%{UserName}##%{Filler6}##%{ERRORMESSAGE}"
			}
		}
	}
}

```

}  
}

output {  
elasticsearch {  
hosts =\> "localhost:9200"  
manage\_template =\> false  
index =\> "elkrft-ind-%{+YYYY.MM.dd}"  
}  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2018, 12:04pm UTC](https://discuss.elastic.co/t/logstash-is-not-breaking-the-logs/151341/4 "2018-11-05T12:04:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.