How to remove date and time in message


how can i remove the date and time from the message field? and above all is it possible?
example screen shot:

I suppose it is possible using grok filter plugin with logstash while ingestion.

i'm already using the grock filter but i can't figure out how to remove the date from the message i tried the gsub function but i didn't succeed here is the example:

if [fields][log_type] == "maillog" {
grok {
break_on_match => false
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}" }
date { match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
mutate {

   gsub => ["message", "\d{3} \d{2} \d{2}:\d{2}:\d{2}", ""]


You can use the dissect filter to parse your original message field and override it with everything else except the date.

     dissect {
         mapping => {
             "message" => "%{} %{} %{}:%{}:%{} %{message}"

This will transform any message with the format:

MMM dd HH:mm:ss some text from your message


some text from your message

For example, Jan 13 14:59:30 sample text will become sample text.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.