# Multiple dissect in logstash

**URL:** <https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring\
**Created:** [October 21, 2020, 9:00pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898 "2020-10-21T21:00:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)\
**Post date:** [October 21, 2020, 9:00pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/1 "2020-10-21T21:00:46Z")

</div>

Hi,

I would like somehow to have multiple dissect or grok  
one for Errorlog :  
`dissect { mapping => { "message" => "[%logdate}] %{exception}.%{CHttpException}.%{logtype}.%{loglevel}: %{errormessage}" } }`

and second one for Info log but the syntax is different:

[2020-10-21 14:51:33] application.INFO:  
"message" =\> "[%logdate}] %{application}.%{loglevel}: %{infomessage}"

1. Is it possible to use "dissect" for two differant syntaxes?
2. if not what can I use?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 21, 2020, 9:17pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/2 "2020-10-21T21:17:09Z")

</div>

You can have multiple dissect filters. The [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html#_conditional_processing) suggests using if conditions to determine which dissect to apply.

---

<div class="post-metadata">

**Author:** ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)\
**Post date:** [October 21, 2020, 9:49pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/3 "2020-10-21T21:49:01Z")

</div>

Hi, thank you very much for your link !! and answer

```
> if[message]=~ /application/{
> dissect {mapping => {"message" => "[%{logdate}] %{application}.%{loglevel}: %{logsmessage}"}}
> }
> else{
> dissect { mapping => { "message" => "[%{logdate}] %{exception}.%{CHttpException}.%{errorcode}.%{loglevel}: %{errormessage}" } }
> }

```

Could you please tell how to correct enter the condition for message ?  
or should I just write if [message]== application{  
}

thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 21, 2020, 10:26pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/4 "2020-10-21T22:26:40Z")

</div>

> [@juuuhuuu](#):
>
> should I just write if [message]== application{

No, that is a string equality test. You can use a regex, as you have shown, or you can use a sub-string match

```
if "application" in [message] {

```

---

<div class="post-metadata">

**Author:** ![juuuhuuu](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@juuuhuuu](https://discuss.elastic.co/u/juuuhuuu)\
**Post date:** [October 21, 2020, 10:36pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/5 "2020-10-21T22:36:39Z")

</div>

> [@Badger](#):
>
> `if "application" in [message] {`

thank you very much for your answer

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2020, 10:36pm UTC](https://discuss.elastic.co/t/multiple-dissect-in-logstash/252898/6 "2020-11-18T22:36:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.