# Is there any way to remove log.syslog.structured\_data

**URL:** <https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899>\
**Category:** Logstash\
**Created:** [March 21, 2024, 12:20pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899 "2024-03-21T12:20:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Madiha\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madiha_samad/32/92117_2.png) [@Madiha\_Samad](https://discuss.elastic.co/u/Madiha_Samad)\
**Post date:** [March 21, 2024, 12:20pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899/1 "2024-03-21T12:20:09Z")

</div>

I am trying to parse checkpoint and fortinet logs through logstash and get log.syslog.structured\_data field in kibana/logscale .Is there any way to remove it ? I know it represents structured data expressed in RFC 5424 messages but I want to exclude that field completely as it's a complete replica of rawstring

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [March 21, 2024, 12:43pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899/2 "2024-03-21T12:43:09Z")

</div>

Welcome to the community!

If you want to delete the field:  
` mutate{ remove_field => ["[log][syslog][structured_data]"] }`

If there is nothing important in all "log" nested field/structure, simply delete:  
` mutate{ remove_field => ["log"] }` # this is an array, can have multiple fields

You can also test on the "event" field.

---

<div class="post-metadata">

**Author:** ![Madiha\_Samad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madiha_samad/32/92117_2.png) [@Madiha\_Samad](https://discuss.elastic.co/u/Madiha_Samad)\
**Post date:** [March 21, 2024, 1:00pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899/3 "2024-03-21T13:00:30Z")

</div>

> [@Madiha\_Samad](#):
>
> log.syslog.structured\_data

Thanks for your reply ,I tried doing that but it didn't work .Here is the filter I am applying

```auto
filter {

 grok {
      match => {"message" => "%{SYSLOG5424PRI}%{GREEDYDATA:message}" }
      overwrite => ["message"]
    }

 mutate {
    remove_field => ["tags", "input", "log", "event", "@timestamp", "agent", "ecs", "@version", "host"]
  }

 kv {
    field_split => " "
    value_split => "="
  }

 mutate {
    remove_field => ["message"]
    rename => { "<(\d+)>date" => "date" }
    add_field => { "logdate" => "%{date} %{time}"}
  }

 date {
 
    match => ["logdate", "yyyy-MM-dd HH:mm:ss"]
    timezone => "Europe/London"
    target => "@timestamp"
  }

 mutate {
 
    remove_field => ["logdate", "date", "time"]
    convert => { "rcvdbyte" => "integer"}
    convert => { "sentbyte" => "integer"}
 
  }
  mutate{ remove_field => ["[log][syslog][structured_data]"] }
 
}
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2024, 1:00pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-remove-log-syslog-structured-data/355899/4 "2024-04-18T13:00:45Z")

</div>

Closed on April 18, 2024, 1:00pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.