# Using \_dissectfailure for matching multiple lines with dissect
**URL:** https://discuss.elastic.co/t/using-dissectfailure-for-matching-multiple-lines-with-dissect/282781
**Category:** Logstash
**Created:** [August 30, 2021, 7:20am UTC](https://discuss.elastic.co/t/using-dissectfailure-for-matching-multiple-lines-with-dissect/282781 "2021-08-30T07:20:09Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@nimblealliance](https://discuss.elastic.co/u/nimblealliance)
#### Post date: [August 30, 2021, 7:20am UTC](https://discuss.elastic.co/t/using-dissectfailure-for-matching-multiple-lines-with-dissect/282781/1 "2021-08-30T07:20:09Z")
Hello 🙂
Could someone please let me know why my below filter using dissect doesn't work? I tried using the "\_dissectfailure" option to parse logs when the first dissect filter fails and returns this tag but it doesn't seem to work :-
```auto
filter
{
dissect
{
mapping => {"message" => "%{time}|%{thread}|%{rest} ,%{bleh1}all %{bleh2} ..."}
}
if "_dissectfailure" in [tags]
{
dissect
{
mapping => {"message" => "%{time}|%{thread}|%{rest}all %{bleh1}......"}
}
}
```
This filter does work when the log lines match the first message but fails when it matches the second. I am new to logstash and as per my understanding the second dissect filter should have worked on this as the first one failed and returns a "\_dissectfailure" tag , please correct me if I am wrong 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2021, 7:20am UTC](https://discuss.elastic.co/t/using-dissectfailure-for-matching-multiple-lines-with-dissect/282781/2 "2021-09-27T07:20:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.