# Json filter message filed

**URL:** https://discuss.elastic.co/t/json-filter-message-filed/236232
**Category:** Logstash
**Created:** [June 8, 2020, 8:46pm UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232 "2020-06-08T20:46:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![iramki90](https://avatars.discourse-cdn.com/v4/letter/i/7ea924/32.png) [@iramki90](https://discuss.elastic.co/u/iramki90)
#### Post date: [June 8, 2020, 8:46pm UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232/1 "2020-06-08T20:46:58Z")

</div>

I currently have 2 different type of log formats coming in Json format.

```auto
message{
id:scenario1
ip:0.0.0.
}
message
{
id:scenario2
message: "This is a message field coming from application"
}
json {
		source => "message"		
		skip_on_invalid_json => true
		 }

```

Situation 1:  
Does not include any message field in it.  
For this: I want to remove the message field as it contains the raw json message.  
Situation 2:  
Includes a message field with some application data in it. For this scenario the above code works fine. It replaces the message field with the data that is coming in.

For situation 1 the raw data is getting published to elastic search. I tried writing some thing like this

```auto
json {
		source => "message"
		tartget => parsedJson
		skip_on_invalid_json => true
		 }
if ![parsedJson][message]
{
mutate {
remove_field => ["message"] ---This is raw data
}

```

But every thing is getting tagged with parsedjson.id and so on..  
Any inputs are appreciated.

---

<div class="post-metadata">

### Author: ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 9, 2020, 3:01am UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232/2 "2020-06-09T03:01:45Z")

</div>

are both messages coming from single source ? if so , you will need a unique identifier that only exists in one of the message.

if they come from different sources, you can tag them on ingestion

---

<div class="post-metadata">

### Author: ![iramki90](https://avatars.discourse-cdn.com/v4/letter/i/7ea924/32.png) [@iramki90](https://discuss.elastic.co/u/iramki90)
#### Post date: [June 9, 2020, 3:25am UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232/3 "2020-06-09T03:25:06Z")

</div>

No, both are coming from different sources to which I don’t have control over.

---

<div class="post-metadata">

### Author: ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)
#### Post date: [June 9, 2020, 3:41am UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232/4 "2020-06-09T03:41:53Z")

</div>

then you can tag them on ingest based on the source host, depending on how you receive them. for example if you receive with syslog, you can tag them in the input section

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 7, 2020, 3:41am UTC](https://discuss.elastic.co/t/json-filter-message-filed/236232/5 "2020-07-07T03:41:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.