# How to strip events from message field? Logstash syslog

**URL:** <https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110>\
**Category:** Logstash\
**Created:** [July 19, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110 "2021-07-19T21:01:29Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 20, 2021, 7:33pm UTC](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110/7 "2021-07-20T19:33:30Z")

</div>

You could try

```
    dissect { mapping => { "message" => "<%{syslogPri}>%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{ip} %{[@metadata][restOfLine]}" } }

    date { match => ["[@metadata][ts]", "MMM dd HH:mm:ss" ] }
    kv { source => "[@metadata][restOfLine]" field_split => "|" }

```

Note that some of your fields are repeated (layer\_name and time) so they will be arrays.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-strip-events-from-message-field-logstash-syslog/279110)._