I want to remove them completely.
I got an advice on stackoverflow to use filter like this:
grok {
pattern => "%{TIMESTAMP_ISO8601:timestamp} %{WORD:app} %{WORD:server} %{GREEDYDATA:message}"
overwrite => [ "message" ]
}
json {
source => "message"
}
But now I'm getting error in log about "Trouble parsing json".