# Logstash Elasticsearch output - one field only

**URL:** <https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395>\
**Category:** Logstash\
**Created:** [October 12, 2022, 3:44am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395 "2022-10-12T03:44:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gunlomboy](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Post date:** [October 12, 2022, 3:44am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/1 "2022-10-12T03:44:23Z")

</div>

Hi,

Is it possible to send only the "message" field to elasticsearch from logstash?

I have tried **codec =\> line { format =\> "%{message}" }** but the full beat output is still sent.

Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 12, 2022, 4:34am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/2 "2022-10-12T04:34:19Z")

</div>

If you are using an elasticsearch output then I do not think you can change the output format. The logstash output knows that elasticsearch expects JSON, so it ignores the codec option that is shared by all outputs.

You may be able to use a prune output with a [whitelist\_names](https://www.elastic.co/guide/en/logstash/current/plugins-filters-prune.html#plugins-filters-prune-whitelist_names) option so that only the [message] field is sent.

---

<div class="post-metadata">

**Author:** ![gunlomboy](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Post date:** [October 12, 2022, 4:52am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/3 "2022-10-12T04:52:56Z")

</div>

Thanks @Badger

I'll try the prune filter.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 12, 2022, 6:00am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/4 "2022-10-12T06:00:38Z")

</div>

Also use [@metadata] fields, and _remove\_field_ which you don't need.

---

<div class="post-metadata">

**Author:** ![gunlomboy](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Post date:** [October 13, 2022, 7:45am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/5 "2022-10-13T07:45:06Z")

</div>

Thanks @Rios, will do.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 13, 2022, 7:49am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/6 "2022-10-13T07:49:11Z")

</div>

Logstash and Elastic apps are flexible, whatever is easier, use it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 10, 2022, 7:49am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-one-field-only/316395/7 "2022-11-10T07:49:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.