# Is there a way to exclude unwanted lines into one event with logstash

**URL:** <https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309>\
**Category:** Logstash\
**Created:** [May 28, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309 "2021-05-28T09:10:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![syrine\_chelly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syrine_chelly/32/84013_2.png) [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\
**Post date:** [May 28, 2021, 9:10am UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309/1 "2021-05-28T09:10:43Z")

</div>

i want to delete certain lines in the messsage field using logstash .I don't want to drop the field just extra lines in the field. is it possible ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 28, 2021, 5:15pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309/2 "2021-05-28T17:15:28Z")

</div>

Are you saying you want to keep only the first line in the message field? If so then you could try

```
mutate { gsub => ["message", "\n.*", ""] }
```

---

<div class="post-metadata">

**Author:** ![syrine\_chelly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syrine_chelly/32/84013_2.png) [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\
**Post date:** [May 30, 2021, 10:26am UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309/3 "2021-05-30T10:26:32Z")

</div>

i don't want just to keep the first line.i want to delete lines into the message field and keep others.I don't find a solution to do it

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 30, 2021, 5:13pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309/4 "2021-05-30T17:13:58Z")

</div>

You need to share an example of your message and what you want to remove to see if it is possible or not and how to do it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2021, 5:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-exclude-unwanted-lines-into-one-event-with-logstash/274309/5 "2021-06-27T17:14:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.