How to remove date and time in message

Elastic Stack Logstash
1

Hi,

how can i remove the date and time from the message field? and above all is it possible?
example screen shot:

image
image1181×212 24.1 KB

2

I suppose it is possible using grok filter plugin with logstash while ingestion.

3

i'm already using the grock filter but i can't figure out how to remove the date from the message i tried the gsub function but i didn't succeed here is the example:

if [fields][log_type] == "maillog" {
grok {
break_on_match => false
match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}" }
}
date { match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
mutate {

   gsub => ["message", "\d{3} \d{2} \d{2}:\d{2}:\d{2}", ""]

}

4

You can use the dissect filter to parse your original message field and override it with everything else except the date.

     dissect {
         mapping => {
             "message" => "%{} %{} %{}:%{}:%{} %{message}"
         }
     }

This will transform any message with the format:

MMM dd HH:mm:ss some text from your message

Into

some text from your message

For example, Jan 13 14:59:30 sample text will become sample text.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.