# How to strip events from message field? Logstash syslog **URL:** \ **Category:** Logstash\ **Created:** [July 19, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110 "2021-07-19T21:01:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![RaonyO](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Post date:** [July 19, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/1 "2021-07-19T21:01:29Z")
hello guys, i'm trying to send logs from a syslog-ng server to logstash and logstash to elasticsearch, but all events are coming in the message field. Is it possible to separate these events to create a new field for each thing? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [July 19, 2021, 10:22pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/2 "2021-07-19T22:22:13Z")
You would need to use a [grok filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html) in Logstash or [grok ingest processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/grok-processor.html) on the elasticsearch side to parse the message into fields. ---
**Author:** ![RaonyO](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Post date:** [July 20, 2021, 1:43pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/3 "2021-07-20T13:43:06Z")
would the kv filter be more viable? because my logs are huge and creating a filter with grok for each field would be almost impossible,I believe that some automatic way of separating would be more viable, do you agree? ---
**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Post date:** [July 20, 2021, 6:23pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/4 "2021-07-20T18:23:01Z")
Most common logs have a preset where you don't need to parse it all out yourself. What type of logs are these? [For example.](https://github.com/hpcugent/logstash-patterns/blob/master/files/grok-patterns#L93) ---
**Author:** ![RaonyO](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Post date:** [July 20, 2021, 7:08pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/5 "2021-07-20T19:08:34Z")
syslog-ng logs.. ```auto "<13>Jul 20 15:27:30 10.241.20.6 time=1626801326|hostname=MGMT-XX|severity=Informational|confidence_level=Medium|product=IPS|action=Detect|ifdir=inbound|ifname=lo|loguid {9x10f3e5yy,0x1c,0x6475cf72,0xeec2e5bc}|origin=xx.xxx.131.3|originsicname=CN|FW01-Out,O|=MGJ.br.atootc|sequencenum=42|time=1626801326|version=5|attack=SSL Enforcement Violation|attack_info=OpenSSL ChaCha20_Poly1305 Cipher Suites|description_url=CVE_2016_7054_help.html|dst=xxx.xx.35.20|https_inspection_action=Inspect|industry_reference=CVE-2016-7054|lastupdatetime=1626805676|log_id=2|malware_rule_id={13B84A4D-2280-4C37-A24E-6FD1377AE144}|performance_impact=3|policy=FRA-POLICY|policy_time=1625860876|protection_id=asm_dynamic_prop_CVE_2016_7054|protection_name=OpenSSL ChaCha20_Poly1305 Cipher Suites|protection_type=IPS|proto=6|received_bytes=3000|rule_name=Webmail|rule_uid=584d05b2-3722-4729-XXXX-XXXX1f7a7b4|s_port=591XX|sent_bytes=1947|service=XXX|session_id={0x60f6e642e,0x3c,0x6475cf72,0xeec2e5bc}|smartdefense_profile=XXXX-IDS|src=xxx.xxx.249.124|suppressed_logs=30|layer_name=IPS|layer_name=F-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_name=IPS|layer_name=FRA-POLICY Threat Prevention|layer_uuid={364B9452-D032-4D02-8358-XXXXXXX} ``` ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 20, 2021, 7:23pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/6 "2021-07-20T19:23:16Z")
I will answer here, rather than in [this duplicate](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183) thread. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [July 20, 2021, 7:33pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/7 "2021-07-20T19:33:30Z")
You could try ``` dissect { mapping => { "message" => "<%{syslogPri}>%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{ip} %{[@metadata][restOfLine]}" } } date { match => ["[@metadata][ts]", "MMM dd HH:mm:ss" ] } kv { source => "[@metadata][restOfLine]" field_split => "|" } ``` Note that some of your fields are repeated (layer\_name and time) so they will be arrays. ---
**Author:** ![RaonyO](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Post date:** [July 21, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/8 "2021-07-21T14:21:08Z")
Thank you @Badger ! this solution solved my problem ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 18, 2021, 2:21pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/9 "2021-08-18T14:21:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.