# Avoid Timestamp and host from the logstash file output

**URL:** https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870
**Category:** Logstash
**Created:** [September 21, 2022, 1:05pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870 "2022-09-21T13:05:50Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![evgrajesh](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@evgrajesh](https://discuss.elastic.co/u/evgrajesh)
#### Post date: [September 21, 2022, 1:05pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/1 "2022-09-21T13:05:50Z")

</div>

Hi I am using very simple configuration.  
Receive strings from TCP input and write to a file  
Sent string  
This is new string 8  
Written in to file  
2022-09-21T12:36:28.278922Z %{host} This is new string 8

I want to avoid the timestamp and%{host} in the file

Can someone suggest. Here is my conf file?

input {  
tcp {  
host =\> "1.1.1.1"  
port =\> 33333  
codec =\> line  
}  
}  
output {  
file {  
path =\> "/var/log/rajeshltrace.log"  
create\_if\_deleted =\> true  
flush\_interval =\> 1  
codec =\> line  
}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 21, 2022, 3:55pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/2 "2022-09-21T15:55:13Z")

</div>

> [@evgrajesh](#):
>
> I want to avoid the timestamp and%{host} in the file

If you do not supply the format option to the line codec then [it will call](https://github.com/logstash-plugins/logstash-codec-line/blob/8036e2b0343da1ee16f9fae0a8f6f456bdb4efd1/lib/logstash/codecs/line.rb#L62) event.to\_s, which adds the timestamp and hostname. Change it to

```
codec => line { format => "%{message}" }

```

---

<div class="post-metadata">

### Author: ![evgrajesh](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@evgrajesh](https://discuss.elastic.co/u/evgrajesh)
#### Post date: [September 21, 2022, 3:58pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/3 "2022-09-21T15:58:50Z")

</div>

Thank you @Badger🙏

---

<div class="post-metadata">

### Author: ![evgrajesh](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@evgrajesh](https://discuss.elastic.co/u/evgrajesh)
#### Post date: [September 21, 2022, 4:03pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/4 "2022-09-21T16:03:00Z")

</div>

One more small query, I could see Hostname getting populated as Ip address when I use UDP but when I use TCP it is displaying as %{host}. Any clue Badger?  
thanks in advance.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 21, 2022, 4:38pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/5 "2022-09-21T16:38:35Z")

</div>

That suggests that when using a tcp input the [host] field does not exist. That would be strange. I would expect it to be a hash, and the output to contain "{name=1.2.3.4}", or whatever your IP is (unless the name can be looked up).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 19, 2022, 4:39pm UTC](https://discuss.elastic.co/t/avoid-timestamp-and-host-from-the-logstash-file-output/314870/6 "2022-10-19T16:39:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
