# How to remove original message field after parsing using json filter

**URL:** https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306
**Category:** Logstash
**Created:** [May 6, 2021, 2:02pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306 "2021-05-06T14:02:25Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Sandeep4](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sandeep4](https://discuss.elastic.co/u/Sandeep4)
#### Post date: [May 6, 2021, 2:02pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306/1 "2021-05-06T14:02:25Z")

</div>

First try:-  
filter {

mutate {

```
     gsub => ["message", "^\w+`string`", ""]

```

}

json {

```
source => "message"
remove_field => "message"

```

}  
}

Second try:-  
filter {

mutate {

```
     gsub => ["message", "^\w+`string`", ""]

```

}

json {

```
source => "message"

```

}

mutate {

```
     remove_field => "message"

```

}

}

Tried both, got parse error, with tag \_jsonparsefailure

Thanks for your help

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 6, 2021, 2:51pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306/2 "2021-05-06T14:51:50Z")

</div>

> [@Sandeep4](#):
>
> Tried both, got parse error, with tag \_jsonparsefailure

I would normally use

```
json { source => "message" remove_field => ["message"] }

```

That will remove the [message] field if it is successfully parsed, otherwise it will leave it on the event, which gives you a chance to see what is wrong with it. Nothing you do with remove\_field will affect whether you get a \_jsonparsefailure tag. That is telling you that the [message] field is not valid JSON.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2021, 2:52pm UTC](https://discuss.elastic.co/t/how-to-remove-original-message-field-after-parsing-using-json-filter/272306/3 "2021-06-03T14:52:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.