# How to do output filter

**URL:** <https://discuss.elastic.co/t/how-to-do-output-filter/181435>\
**Category:** Logstash\
**Created:** [May 16, 2019, 3:15pm UTC](https://discuss.elastic.co/t/how-to-do-output-filter/181435 "2019-05-16T15:15:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![akhettal](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@akhettal](https://discuss.elastic.co/u/akhettal)\
**Post date:** [May 16, 2019, 3:15pm UTC](https://discuss.elastic.co/t/how-to-do-output-filter/181435/1 "2019-05-16T15:15:12Z")

</div>

Hi,

Here is my output logstash.conf

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "logs-%{[@metadata][index]}-v6-%{+YYYY.MM.dd}"  
manage\_template =\> false  
}

```
    if [@type]== "x" {
    file {
    path => "/home/x.log"}
    }

```

}

The already existing filter give me this logs on output :

{"syslog\_procid":"-","@message":"IdentityProviderAuthenticationSuccess ('test')","@index\_type":"platform","geoip":{},"syslog\_sd\_id":"instance@47450","syslog\_sd\_params":{"director":"brmc-prod","group":"uaa","az":"z2","id":"id","deployment":"cf"},"@raw":`*"<14>1 2019-05-16T14:55:48.156790+00:00 172.17.8.25 vcap.uaa - - [instance@47450 director=\"director \" deployment=\"cf\" group=\"uaa\" az=\"z2\" id=\"id\"] [2019-05-16 14:55:48.156] uaa - 1 [http-nio-8080-exec-3] .... INFO --- Audit: IdentityProviderAuthenticationSuccess ('test'): principal=principal, origin=[remoteAddress=172.17.0.11, clientId=cf], identityZoneId=[uaa], authenticationType=[ldap]"*`,"@src":{"az":"z2","deployment":"cf","job":"uaa","id":"id","host":"172.17.8.25","component":"uaa","type":"cf"},"syslog\_msgid":"-","syslog5424\_ver":1,"@input":"syslog","tags":["syslog\_standard","platform","cf","uaa","audit","\_geoip\_lookup\_failure"],"@shipper":{"priority":"14","name":"vcap.uaa\_syslog"},"uaa":{"log\_category":"Audit","pid":1,"thread":"http-nio-8080-exec-3","audit":{"origin":["remoteAddress=172.17.0.11","clientId=cf"],"identity\_zone\_id":"uaa","principal":"principal","data":"test","remote\_address":"172.17.0.11","type":"IdentityProviderAuthenticationSuccess"},"timestamp":"2019-05-16 14:55:48.156"},"@timestamp":"2019-05-16T14:55:48.156Z","@level":"INFO","@type":"uaa-audit"}

Do you know how can i cut the italic part of this log in the file ouput conf?  
Maybe with a codec?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2019, 3:15pm UTC](https://discuss.elastic.co/t/how-to-do-output-filter/181435/2 "2019-06-13T15:15:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.