# Get message content without message tag in logstash
**URL:** https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714
**Category:** Logstash
**Created:** [January 25, 2019, 7:56am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714 "2019-01-25T07:56:51Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 25, 2019, 7:56am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/1 "2019-01-25T07:56:51Z")
Hello everyone,
This is the config file i used.
```
input {
syslog {
port => 514
}
}
filter{
mutate {
remove_field => ["facility_label","facility","@version","priority","tags","host","timestamp","severity_label","severity","logsource"]
split => { "message" => "," }
}
}
output {
stdout {}
file {
path => "E:/sample.txt"
}
}
```
> This is the output i got
{"message":["1","2019/01/06 22:26:23","001606074152","TRAFFIC","end","1","2019/01/06 22:26:23","103.62.17.6","111.93.8.19","103.62.17.6","192.168.11.16","WAN-LAN","","","ms-rdp","vsys1","untrust","trust","ethernet1/3","ethernet1/4","Kiwi Syslog","2019/01/06 22:26:23","53938","1","62225","3389","62225","3389","0x400050","tcp","allow","3637","1644","1993","17","2019/01/06 22:26:05","3","any","0","361598785","0x0","IN","IN","0","9","8","tcp-rst-from-client","0","0","0","0","","PA-200","from-policy "]}
> but i want output as
"1","2019/01/06 22:26:23","001606074152","TRAFFIC","end","1","2019/01/06 22:26:23","103.62.17.6","111.93.8.19","103.62.17.6","192.168.11.16","WAN-LAN","","","ms-rdp","vsys1","untrust","trust","ethernet1/3","ethernet1/4","Kiwi Syslog","2019/01/06 22:26:23","53938","1","62225","3389","62225","3389","0x400050","tcp","allow","3637","1644","1993","17","2019/01/06 22:26:05","3","any","0","361598785","0x0","IN","IN","0","9","8","tcp-rst-from-client","0","0","0","0","","PA-200","from-policy "
> still i can't declare field names n pattern of output.because that may vary.output can be db or csv.help me
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [January 25, 2019, 9:48am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/2 "2019-01-25T09:48:20Z")
This is a _guess_ as I have never had to do this myself...
Maybe use the [CSV output](https://www.elastic.co/guide/en/logstash/6.5/plugins-outputs-csv.html)
---
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 25, 2019, 9:51am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/3 "2019-01-25T09:51:15Z")
can i use csv output without mentioning fields
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [January 25, 2019, 9:59am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/4 "2019-01-25T09:59:37Z")
Right, looks like you need to define them. I though I had read somewhere that fields could be auto generated. Must have been some other CSV tool...
---
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 25, 2019, 10:02am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/5 "2019-01-25T10:02:28Z")
i need it in log stash without using any other tool
---
### Author:  [@A\_B](https://discuss.elastic.co/u/A_B)
#### Post date: [January 25, 2019, 10:08am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/6 "2019-01-25T10:08:04Z")
More guess work, sorry...
You might be able to achieve that by changing the [codec](https://www.elastic.co/guide/en/logstash/6.5/plugins-outputs-file.html#plugins-outputs-file-codec) of the `file` output
> Default value is "json\_lines"
---
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 25, 2019, 2:53pm UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/7 "2019-01-25T14:53:18Z")
which value i should place for codec to get that output. i tried with json
codec =\> json
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 25, 2019, 3:17pm UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/8 "2019-01-25T15:17:07Z")
The default codec for a file output is json\_lines. You could try using a plain codec with a message format. Use a literal embedded newline to tell it to append a newline to the message.
```
output { file { path => "/path/to/file.txt" codec => plain { format => "%{message}
" } } }
```
---
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 28, 2019, 10:27am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/9 "2019-01-28T10:27:03Z")
> how can we add one more field along with message
`codec => line { format => "%{[message]}","%{[@timestamp]}"}` i tried this i got error
Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 16, column 43 (byte 357) after output {\n stdout {}\n file {\n path =\> "E:/testpaloaltomessage.txt" \n\t\tcodec =\> line { format =\> "%{[message]}"", :backtrace=\>["E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/compiler.rb:49:in `compile\_graph'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in `map'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:149:in `initialize'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:22:in `initialize'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/pipeline.rb:90:in `initialize'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/pipeline\_action/create.rb:42:in `block in execute'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/agent.rb:92:in `block in exclusive'", "org/jruby/ext/thread/Mutex.java:148:in `synchronize'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/agent.rb:92:in `exclusive'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash/pipeline\_action/create.rb:38:in `execute'", "E:/softwares/logstash-6.5.4/logstash-core/lib/logstash
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 28, 2019, 1:45pm UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/10 "2019-01-28T13:45:29Z")
If you want to prepend the timestamp use
```
output { stdout { codec => plain { format => "%{@timestamp} %{message}
" } } }
```
---
### Author:  [@manasapp](https://discuss.elastic.co/u/manasapp)
#### Post date: [January 30, 2019, 9:35am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/11 "2019-01-30T09:35:00Z")
Thank u Mr.Badger
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2019, 9:35am UTC](https://discuss.elastic.co/t/get-message-content-without-message-tag-in-logstash/165714/12 "2019-02-27T09:35:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.