﻿---
title: Dissect processor
description: The Dissect processor parses structured log messages and extracts fields from them. It uses a set of delimiters to split the log message into fields instead...
url: https://www.elastic.co/elastic/docs-builder/docs/2564/solutions/observability/streams/management/extract/dissect
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available since 9.2, Preview in 9.1
---

# Dissect processor
The **Dissect** processor parses structured log messages and extracts fields from them. It uses a set of delimiters to split the log message into fields instead of predefined patterns to match the log messages.
Dissect is much faster than Grok, and is recommend for log messages that follow a consistent, structured format.
To parse a log message with a dissect processor:
1. Select **Create** → **Create processor**.
2. Select **Dissect** from the **Processor** menu.
3. Set the **Source Field** to the field you want to dissect.
4. Set the delimiters you want to use in the **Pattern** field. Refer to the [example pattern](#streams-dissect-example) for more information on setting delimiters.

This functionality uses the Elasticsearch [Dissect processor](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/2564/reference/enrich-processor/dissect-processor) internally, but you configure it in Streamlang. Streamlang doesn’t always have 1:1 parity with the ingest processor options and behavior. Refer to [Processor limitations and inconsistencies](/elastic/docs-builder/docs/2564/solutions/observability/streams/management/extract#streams-processor-inconsistencies).

## Example dissect pattern

The following example shows the dissect pattern for an unstructured log message.
**Log message:**
```
2025-04-04T09:04:45+00:00 ERROR 160.200.87.105 127.79.135.127 21582
```

**Dissect Pattern:**
```
%{timestamp} %{log.level} %{source.ip} %{destination.ip} %{destination.port}
```