How to remove date and time in message

[Roccof97 (Rocco)]

Hi,

how can i remove the date and time from the message field? and above all is it possible?
example screen shot:

[Tomo_M (Tomohiro Mitani)]

I suppose it is possible using grok filter plugin with logstash while ingestion.

[Roccof97 (Rocco)]

i'm already using the grock filter but i can't figure out how to remove the date from the message i tried the gsub function but i didn't succeed here is the example:

if [fields][log_type] == "maillog" {
grok {
break_on_match => false
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}" }
}
date { match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
mutate {

   gsub => ["message", "\d{3} \d{2} \d{2}:\d{2}:\d{2}", ""]

}

[leandrojmp (Leandro Pereira)]

You can use the dissect filter to parse your original message field and override it with everything else except the date.

     dissect {
         mapping => {
             "message" => "%{} %{} %{}:%{}:%{} %{message}"
         }
     }

This will transform any message with the format:

MMM dd HH:mm:ss some text from your message

Into

some text from your message

For example, Jan 13 14:59:30 sample text will become sample text.