# Can i strip different values from "message" field

**URL:** <https://discuss.elastic.co/t/can-i-strip-different-values-from-message-field/328018>\
**Category:** Logstash\
**Created:** [March 19, 2023, 11:18am UTC](https://discuss.elastic.co/t/can-i-strip-different-values-from-message-field/328018 "2023-03-19T11:18:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hramoff](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hramoff/32/118619_2.png) [@Hramoff](https://discuss.elastic.co/u/Hramoff)\
**Post date:** [March 19, 2023, 11:18am UTC](https://discuss.elastic.co/t/can-i-strip-different-values-from-message-field/328018/1 "2023-03-19T11:18:48Z")

</div>

I am using logstash with syslog plugin to collect logs from vsphere. The problem is that I get a lot of unnecessary entries, over 12,000 different rows per minute.

I want to whitelist only the values ​​that I want in the message field.

For example, I want to keep logs only if the "Message" field contains an administrator account.

Can I split "Message" into fields and remove unnecessary ones.

I give an example of configs:

`<134>1 2023-03-19T10:51:28.792214+00:00 vs vsan-health-main - - - (vim.cluster.VsanObjectSpaceSummary) {`  
I don't want to store such a field

`<14>1 2023-03-19T10:37:08.771275+00:00 vs vpxd 17644 - - Event [29210] [1-1] [2023-03-19T10:37:08.770929Z] [vim.event.VmRemovedEvent] [info] [VSPHERE.LOCAL\Hramoff] [Datacenter-1] [29208] [Removed <mark>CLI</mark> on esxi2.vs.loc from Datacenter-1]`

and this is the field I want to store

---

<div class="post-metadata">

**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\
**Post date:** [March 20, 2023, 4:07am UTC](https://discuss.elastic.co/t/can-i-strip-different-values-from-message-field/328018/2 "2023-03-20T04:07:28Z")

</div>

> [@Hramoff](#):
>
> I am using logstash with syslog plugin to collect logs from vsphere. The problem is that I get a lot of unnecessary entries, over 12,000 different rows per minute.
> 
> I want to whitelist only the values ​​that I want in the message field.
> 
> For example, I want to keep logs only if the "Message" field contains an administrator account.
> 
> Can I split "Message" into fields and remove unnecessary ones.

can you elaborate on how you define an administrator account so the parsing logic can reflect that task.

In some cases, the syslog message may contain an "AUTHOR" or "USER" field that identifies the user account associated with the message. In other cases, it may look for patterns in the "message" field itself that indicate that the message is from an administrator account.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2023, 4:08am UTC](https://discuss.elastic.co/t/can-i-strip-different-values-from-message-field/328018/3 "2023-04-17T04:08:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.