Question regarding question 4 of the Observability practice exam

Hi All,

I am attempting question 4 of the practice exam, and am stuck on how to use the dissect processor to escape the "\t" character:

The Input sample pipeline document is as follows:

{
"_source": {
"message": "2020-10-22T20:28:26.267397Z\t 12 Query\tset session transaction read write"
}
}

The Dissect string pattern I am using is as follows:

%{@timestamp}\t %{process.thread.id} %{event.action}\t%{message}

However, I keep getting the following error when testing it using the sample document:

{
  "docs": [
    {
      "error": {
        "root_cause": [
          {
            "type": "find_match",
            "reason": "Unable to find match for dissect pattern: %{@timestamp}\\t %{process.thread.id} %{event.action}\\t%{message} against source: 2020-10-22T20:28:26.267397Z\t 12 Query\tset session transaction read write"
          }
        ],
        "type": "find_match",
        "reason": "Unable to find match for dissect pattern: %{@timestamp}\\t %{process.thread.id} %{event.action}\\t%{message} against source: 2020-10-22T20:28:26.267397Z\t 12 Query\tset session transaction read write"
      }
    }
  ]
}

Any ideas on how to escape the "\t" character would be appreciated.

I'm not entirely sure what the issue might be, the "answer" (or at least, an answer) is:

"dissect": {
      "field": "message",
      "pattern": "%{@timestamp}\t%{->} %{process.thread.id} %{event.action}\t%{message}"
}

Which does seem to mostly match what you've written.

You could try using the Load JSON button, and pasting this complete solution code in:

{
"processors": [
  {
    "dissect": {
      "field": "message",
      "pattern": "%{@timestamp}\t%{->} %{process.thread.id} %{event.action}\t%{message}"
    }
  },
  {
    "lowercase": {
      "field": "event.action"
    }
  },
  {
    "set": {
      "field": "event.category",
      "value": "database"
    }
  }
]
}

Hi Will,

Thanks a lot J

Also, with regards to entering a tab character in the ingest dissect processor pattern, there was an issue depending on what version of ELK that was being used that I have found:

· For v7.9.1: Need to type "\t"

· For v7.10.1: Need to copy and paste the actual tab space character (i.e." ", with no spaces) from an editor like notepad or notepad++, and not from vi or nano in the linux terminal

Will we have access to a graphical editor similar to notepad or notepad++ during the exam? We require the tab character from an editor similar to these, as apparently the vi or nano editor provided by the terminal does not provide an adequate tab character needed for the ingest pipeline processor dissect in kibana. Does the On-screen keyboard in the exam desktop contain this tab space character that can be copied onto the dissect pattern?

Regards,

Evangelo Karagiannis

0431 826 759

FWIW, none of this conversation about tab characters is an issue on the exam.

And when the head of Certification says it's not an issue, it's not an issue. :slight_smile:

Thanks for looking into the bug here, though! Clearly we picked a less than ideal log format for the practice exam!