Suppress Dissector mapping failure logs

Elastic Stack Logstash
1

Hi,

I have some dissect filters in my configuration file which fail at certain points in time. Failure as such causes logstash to write a message on the lines of:

[2019-06-14T00:00:00,232][WARN ][org.logstash.dissect.Dissector] Dissector mapping, pattern not found {"field"=>"message1", "pattern"=>"%{daemonmsg}. Exit status %{exitstatus} returned %{function}", "event"=>{"message"=>"info 183: Daemon service checking status. @checkServiceStatus", "message1"=>"Daemon service checking status. @checkServiceStatus", "hostname"=>"app133220.sea3.service-now.com", "timestamp"=>"Jun 13 23:59:57", "@timestamp"=>2019-06-14T06:59:57.000Z, "@version"=>"1", "code"=>"183", "source"=>"/var/log/messages", "process"=>"snc.cid.cloudrunner", "level"=>"info", "tags"=>["log", "_snccloudrunner_info_main_dissectfailure", "_snccloudrunner_info_second_dissectfailure"], "log"=>{"file"=>{"path"=>"/var/log/messages"}}}}

At /var/log/logstash/logstash-plain.log, is there any way i can suppress dissector mapping failure log and prevent it from being logged as it is causing clutter in my log messages.

Thanks,
Vivek

2

added:

logger.dissect.name = logstash.filters.dissect

logger.dissect.level = ERROR

in my log4j2.properties file cant see any changes

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

4

Try below, where filterdissect is an arbitrary name:

logger.filterdissect.name = org.logstash.dissect.Dissector
logger.filterdissect.level = ERROR
1 Like