# How to stop message from being sent after grok

**URL:** <https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211>\
**Category:** Logstash\
**Created:** [August 11, 2015, 6:08pm UTC](https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211 "2015-08-11T18:08:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\
**Post date:** [August 11, 2015, 6:08pm UTC](https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211/1 "2015-08-11T18:08:28Z")

</div>

I have a logstash agent on a box. It gets data (from redis), does a grok and parses things apart, and then sends the JSON to another box, where elastic brings it in.

The message is grok'd, and then gets sent along with the JSON.

How can I stop the message from being sent? It is getting indexed, and I don't need it to, as I've broken everything out with the grok. What can I set in my logstash.conf that will stop it from being sent.

I realize I can use a template on the ES box, and I will. But I am doing some troubleshooting, and would like to know how to do this.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 11, 2015, 7:57pm UTC](https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211/2 "2015-08-11T19:57:18Z")

</div>

Use the `remove_field` parameter to the grok filter to have it remove the `message` field if the grok is successful.

```
filter {
  grok {
    ...
    remove_field => ["message"]
  }
}
```

---

<div class="post-metadata">

**Author:** ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)\
**Post date:** [August 11, 2015, 8:00pm UTC](https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211/3 "2015-08-11T20:00:22Z")

</div>

I can't believe it was that easy. Thanks so much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:32am UTC](https://discuss.elastic.co/t/how-to-stop-message-from-being-sent-after-grok/27211/4 "2017-07-06T05:32:16Z")

</div>