# Suppress Dissector mapping failure logs

**URL:** <https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785>\
**Category:** Logstash\
**Created:** [June 14, 2019, 7:36am UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785 "2019-06-14T07:36:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [June 14, 2019, 7:36am UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785/1 "2019-06-14T07:36:02Z")

</div>

Hi,

I have some dissect filters in my configuration file which fail at certain points in time. Failure as such causes logstash to write a message on the lines of:

[2019-06-14T00:00:00,232][WARN][org.logstash.dissect.Dissector] Dissector mapping, pattern not found {"field"=\>"message1", "pattern"=\>"%{daemonmsg}. Exit status %{exitstatus} returned %{function}", "event"=\>{"message"=\>"info 183: Daemon service checking status. @checkServiceStatus", "message1"=\>"Daemon service checking status. @checkServiceStatus", "hostname"=\>"[app133220.sea3.service-now.com](http://app133220.sea3.service-now.com)", "timestamp"=\>"Jun 13 23:59:57", "@timestamp"=\>2019-06-14T06:59:57.000Z, "@version"=\>"1", "code"=\>"183", "source"=\>"/var/log/messages", "process"=\>"snc.cid.cloudrunner", "level"=\>"info", "tags"=\>["log", "\_snccloudrunner\_info\_main\_dissectfailure", "\_snccloudrunner\_info\_second\_dissectfailure"], "log"=\>{"file"=\>{"path"=\>"/var/log/messages"}}}}

At /var/log/logstash/logstash-plain.log, is there any way i can suppress dissector mapping failure log and prevent it from being logged as it is causing clutter in my log messages.

Thanks,  
Vivek

---

<div class="post-metadata">

**Author:** ![vivekkarne](https://avatars.discourse-cdn.com/v4/letter/v/f08c70/32.png) [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\
**Post date:** [June 14, 2019, 10:46am UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785/2 "2019-06-14T10:46:25Z")

</div>

added:

logger.dissect.name = logstash.filters.dissect

logger.dissect.level = ERROR

in my log4j2.properties file cant see any changes

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2019, 10:46am UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785/3 "2019-07-12T10:46:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![Peter\_Loh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peter_loh/32/55546_2.png) [@Peter\_Loh](https://discuss.elastic.co/u/Peter_Loh)\
**Post date:** [May 29, 2020, 8:58pm UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785/4 "2020-05-29T20:58:46Z")

</div>

Try below, where filterdissect is an arbitrary name:

```
logger.filterdissect.name = org.logstash.dissect.Dissector
logger.filterdissect.level = ERROR
```