# Logstash Extract message field .log file

**URL:** <https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577>\
**Category:** Logstash\
**Created:** [June 1, 2021, 5:48am UTC](https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577 "2021-06-01T05:48:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fredsson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fredsson/32/83575_2.png) [@fredsson](https://discuss.elastic.co/u/fredsson)\
**Post date:** [June 1, 2021, 5:48am UTC](https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577/1 "2021-06-01T05:48:59Z")

</div>

Hey guys,

i play a bit with the Elastic Stack and i try to visualize some log files.  
i allready read so many topics how to filter these files, but i didn't get a solution, hopefully i can get some help here 🙂

**File .log file looks like this:**

```auto
      {
      level: 'info',
      message: 'Updating status for user: 8b57ec08-08df-47d3-80b6-de203b9ed314',
      timestamp: '2021-05-18 14:01:33'
    }
    {
      level: 'debug',
      message: 'Detecting stale user status entries in database...30 min',
      timestamp: '2021-05-18 14:01:33'
    }
    {
      level: 'error',
      message: 'Updating status for user: 8b57ec08-08df-47d3-80b6-de203b9ed314',
      timestamp: '2021-05-18 14:02:13'
    }

```

**My logstash.conf file:**

```auto
    input {

        file {

                codec => multiline {

                pattern => "{"

               negate => "true"

                what => "next"

            }

            path => "/usr/share/logstash/data/file.log"

            start_position => "beginning"

            sincedb_path => "/dev/null"

        }

    }
                  

    filter {

            grok {

               match => {

                   "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"

               }

            }

    }

    output {

        elasticsearch {

            hosts => "elasticsearch:9200"

            user => "elastic"

            password => "changeme"

            ecs_compatibility => disabled

            index => "%{[host]}-%{+YYYY.MM.dd}" 

            }

    }

```

Elasticsearch import the the file and all information are in the message field. I would like to extract the message field in the field "level", "message" and "timestamp" that i can select which one i would like see in the Dashboard. Since 1 week i try this and i and already tried out with dissect and mutate, but nothing works for me.

Please help me!

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 30, 2021, 12:24pm UTC](https://discuss.elastic.co/t/logstash-extract-message-field-log-file/274577/3 "2021-06-30T12:24:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.