# Logstash grok matching entire filebeat message instead of message inside
**URL:** https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976
**Category:** Logstash
**Created:** [November 4, 2016, 5:41am UTC](https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976 "2016-11-04T05:41:27Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 4, 2016, 5:41am UTC](https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976/1 "2016-11-04T05:41:27Z")
I have setup Filebeat -\> Kafka -\> Logstash -\> Elasticseatch system.
I have filebeat output like;
```
{"@timestamp":"2016-11-04T05:16:16.108Z","beat":{"hostname":"localhost","name":"localhost","version":"5.0.0"},"fields":{"logtype":"logfile"},"input_type":"log","message":"\u003cOct 31, 2016 6:37:40:678 AM\u003e \u003cdataa\u003e \u003cdatab\u003e \u003cdatac\u003e \u003datad\u003e \u003cdatae\u003e \u003cdataf\u003e \u003cgatag\u003e\n \u003cdatah\u003e","offset":273,"source":"/logfiles/logfile.log","type":"logfile"}
```
I have setup logstash grok to match this message like;
```
grok {
match => { "message" => "%{GREEDYDATA:messageDataA}" }
}
```
But it is pushing entire beat data like @timestamp, hostname, etc (the whole filebeat output line I have mentioned above) to `messageDataA` field. But I want to push only the `message` part inside filebeat message to be pushed. How can I do this? I am using 5.0 GA of Filebeat and Logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 4, 2016, 5:53am UTC](https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976/2 "2016-11-04T05:53:53Z")
It sounds like you're missing a `codec => json` setting in your kafka input. Please show your configuration and the output of a `stdout { codec => rubydebug }` output.
Using grok to copy data from one field to another is inefficient and unnecessary. Use a mutate filter to rename the field instead (or copy the field value with add\_field if you really want to keep both fields).
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 4, 2016, 5:59am UTC](https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976/3 "2016-11-04T05:59:21Z")
`codec => json` solved the issue. Thanks a lot 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/logstash-grok-matching-entire-filebeat-message-instead-of-message-inside/64976/4 "2017-07-06T04:31:11Z")