How to remove original message field after parsing using json filter

[Sandeep4 (Sandeep)]

First try:-
filter {

mutate {

     gsub => [ "message", "^\w+`string`", "" ]

}

json {

source => "message"
remove_field => "message"

}
}

Second try:-
filter {

mutate {

     gsub => [ "message", "^\w+`string`", "" ]

}

json {

source => "message"

}

mutate {

     remove_field => "message"

}

}

Tried both, got parse error, with tag _jsonparsefailure

Thanks for your help

[Badger]

@Sandeep4

Tried both, got parse error, with tag _jsonparsefailure

I would normally use

json { source => "message" remove_field => [ "message" ] }

That will remove the [message] field if it is successfully parsed, otherwise it will leave it on the event, which gives you a chance to see what is wrong with it. Nothing you do with remove_field will affect whether you get a _jsonparsefailure tag. That is telling you that the [message] field is not valid JSON.