# Get pre-filter raw message

**URL:** https://discuss.elastic.co/t/get-pre-filter-raw-message/33533
**Category:** Logstash
**Created:** [November 2, 2015, 3:36pm UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533 "2015-11-02T15:36:01Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![raffis](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@raffis](https://discuss.elastic.co/u/raffis)
#### Post date: [November 2, 2015, 3:36pm UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/1 "2015-11-02T15:36:02Z")

</div>

How can I get the original raw message?

I got two outputs, the first one should log the original raw log message and the second one the whole filtered stuff.  
But I can't do input -\> output -\> filter -\> output right?

So how can I log the raw text message in my first output and my modified %{message} in the second one?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2015, 6:36pm UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/2 "2015-11-02T18:36:27Z")

</div>

There's no obvious way. What kind of outputs do you have?

---

<div class="post-metadata">

### Author: ![raffis](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@raffis](https://discuss.elastic.co/u/raffis)
#### Post date: [November 2, 2015, 8:59pm UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/3 "2015-11-02T20:59:53Z")

</div>

"file" for untouched raw messages and elasticsearch

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2015, 9:12pm UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/4 "2015-11-02T21:12:25Z")

</div>

Okay, that's good. As your first filter, copy the `message` field into a subfield of `@metadata`. Those fields aren't sent to ES (or other output, with a few exceptions). Then adjust the `message_format` option of your file output to reference the saved field.

```
output {
  file {
    ...
    message_format => "%{[@metadata][raw_message]}"
  }
  ...
}
```

---

<div class="post-metadata">

### Author: ![raffis](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@raffis](https://discuss.elastic.co/u/raffis)
#### Post date: [November 3, 2015, 10:59am UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/5 "2015-11-03T10:59:45Z")

</div>

This is exactly what I was looking for, awesome.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533/6 "2017-07-06T05:24:20Z")

</div>