Dissect processor

The Dissect processor parses structured log messages and extracts fields from them. It uses a set of delimiters to split the log message into fields instead of predefined patterns to match the log messages.

Dissect is much faster than Grok, and is recommended for log messages that follow a consistent, structured format.

To parse a log message with a dissect processor:

Select Create → Create processor.
Select Dissect from the Processor menu.
Set the Source Field to the field you want to dissect.
Set the delimiters you want to use in the Pattern field. Refer to the example pattern for more information on setting delimiters.

This functionality uses the Elasticsearch Dissect processor internally, but you configure it in Streamlang. Streamlang doesn’t always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

Example dissect pattern

The following example shows the dissect pattern for an unstructured log message.

Log message:

2025-04-04T09:04:45+00:00 ERROR 160.200.87.105 127.79.135.127 21582

Dissect Pattern:

%{timestamp} %{log.level} %{source.ip} %{destination.ip} %{destination.port}

Generate patterns

Note

This feature requires a Generative AI connector.

Instead of writing the dissect patterns by hand, you can select Generate patterns to have AI generate them for you.

Generated patterns work best on semi-structured data. For very custom logs with a lot of text, creating patterns manually generally creates more accurate results.

To add a generated dissect pattern:

Select Create processor.
Select Dissect from the Processor menu.
Select Generate pattern.
Select Accept to add a generated pattern to the list of patterns used by the processor.

How does Generate patterns work?

Streams groups the samples from the Data preview table into categories of similar messages. For each category, Streams generates suggestions by sending samples to the LLM. Suggestions are then shown in the UI.

Warning

This can incur additional costs, depending on the LLM connector you are using. Typically a single iteration uses between 1000 and 5000 tokens depending on the number of identified categories and the length of the messages.

YAML reference

In YAML mode, configure the dissect processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter	Type	Required	Description
`from`	string	Yes	Source field to parse.
`pattern`	string	Yes	Dissect pattern with `%{field}` placeholders.
`append_separator`	string	No	Separator used when concatenating target fields.
`ignore_missing`	boolean	No	When `true`, skip this processor if the source field is missing.

- action: dissect
  from: body.message
  pattern: "%{attributes.timestamp} %{attributes.level} %{attributes.message}"