i can summarize here, what i need .
see below the output generated by filebeat :
{"@timestamp":"2020-11-26T13:19:24.149Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.10.0"},"log":{"file":{"path":"/logs-nfs/syslog-ng/XXXX/appli.log"}},"message":"2020-11-26T14:19:23+01:00 servermaster CORE: TimeStamp=\"2020-11-26 14:19:23.560\" TraceID=\"TIDcb28e32379fd73bdbe896cqsdsdd979ffc\" LogType=\"APPLI_LOG\" MessType=\"QUEING\" StateInd=\"0\" ErrCode=\"0\" ErrMess=\"Operation successful\" Serial=\"TID04b55dab01dsdfdsac13141b\" TicketNBR=\"4\"","input":{},"agent":{"hostname":"filebeatserver","ephemeral_id":"2488c327-71c6-4bcb-a747-eee5b86190a0","id":"91f74f15-737a-42df-b5d7-c629b3dd9e74","name":"filebeatserver","type":"filebeat","version":"7.10.0"},"ecs":{"version":"1.6.0"},"host":{"name":"filebeatserver"}}
the needed is to keep just this part of output , and remove the rest :
2020-11-26T14:19:23+01:00 servermaster CORE: TimeStamp=\"2020-11-26 14:19:23.560\" TraceID=\"TIDcb28e32379fd73bdbe896cqsdsdd979ffc\" LogType=\"APPLI_LOG\" MessType=\"QUEING\" StateInd=\"0\" ErrCode=\"0\" ErrMess=\"Operation successful\" Serial=\"TID04b55dab01dsdfdsac13141b\" TicketNBR=\"4\"
many thanks for helps
sai