Why is my logstash skipping delimiter in dissect mapping?

Elastic Stack Logstash
1

Hi,

I am using GA 6.3.0. I am taking input from Kafka. I have messages like;

<Jul 18, 2018 4:39:53:857 PM> <> <> <> <> <qqq.wwww.eeee.RrrrrTttttt> <qwerty>\n <INFO : khkas sdahkhahsk ldsahkhk dsfalk kjhdsfkahkh. >

I am using the dessect filter to chop it like;

filter {
  dissect {
    mapping => {
      "message" => "<%{timestamp}> <%{f1}> <%{f2}> <%{f3}> <%{f4}> <%{f5}> <%{f6}>\n <%{f7}"
    }
  }
}

But everything is perfect till f5. Then f6 become blank (it should contain qwerty in this case) and f7 will contain both f6 and f7 data. Why is this happening? How to fix this?

Thanks.

2

It's related to the \n. Is that a newline? The following configuration parses the line correctly.

    input { generator { count => 1 message => '<Jul 18, 2018 4:39:53:857 PM> <> <> <> <> <qqq.wwww.eeee.RrrrrTttttt> <qwerty> 
 <INFO : khkas sdahkhahsk ldsahkhk dsfalk kjhdsfkahkh. >' } }
    output { stdout { codec => rubydebug } }
    filter {
        dissect { mapping => { "message" => "<%{timestamp}> <%{f1}> <%{f2}> <%{f3}> <%{f4}> <%{f5}> <%{f6}>
 <%{f7}" } }
    }
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.