# Why is my logstash skipping delimiter in dissect mapping?

**URL:** https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138
**Category:** Logstash
**Created:** [July 30, 2018, 9:26am UTC](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138 "2018-07-30T09:26:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [July 30, 2018, 9:26am UTC](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138/1 "2018-07-30T09:26:31Z")

</div>

Hi,

I am using GA 6.3.0. I am taking input from Kafka. I have messages like;

```
<Jul 18, 2018 4:39:53:857 PM> <> <> <> <> <qqq.wwww.eeee.RrrrrTttttt> <qwerty>\n <INFO : khkas sdahkhahsk ldsahkhk dsfalk kjhdsfkahkh. >

```

I am using the `dessect` filter to chop it like;

```
filter {
  dissect {
    mapping => {
      "message" => "<%{timestamp}> <%{f1}> <%{f2}> <%{f3}> <%{f4}> <%{f5}> <%{f6}>\n <%{f7}"
    }
  }
} 

```

But everything is perfect till `f5`. Then `f6` become blank (it should contain `qwerty` in this case) and `f7` will contain both `f6` and `f7` data. Why is this happening? How to fix this?

Thanks.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 30, 2018, 1:19pm UTC](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138/2 "2018-07-30T13:19:14Z")

</div>

It's related to the \n. Is that a newline? The following configuration parses the line correctly.

```
    input { generator { count => 1 message => '<Jul 18, 2018 4:39:53:857 PM> <> <> <> <> <qqq.wwww.eeee.RrrrrTttttt> <qwerty> 
 <INFO : khkas sdahkhahsk ldsahkhk dsfalk kjhdsfkahkh. >' } }
    output { stdout { codec => rubydebug } }
    filter {
        dissect { mapping => { "message" => "<%{timestamp}> <%{f1}> <%{f2}> <%{f3}> <%{f4}> <%{f5}> <%{f6}>
 <%{f7}" } }
    }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2018, 1:19pm UTC](https://discuss.elastic.co/t/why-is-my-logstash-skipping-delimiter-in-dissect-mapping/142138/3 "2018-08-27T13:19:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.