# Logstash Input adds data stamp and host

**URL:** <https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021>\
**Category:** Logstash\
**Created:** [January 11, 2022, 10:56am UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021 "2022-01-11T10:56:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [January 11, 2022, 10:56am UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/1 "2022-01-11T10:56:40Z")

</div>

I am using Logstash to receive data from a syslog server and push it into different Kafka topics. Logstash appears to add a data/time stamp and hostname at that start of the raw event. Is there a way stop this happening? I am grabbing raw audit events and pushing them to different topics but need to capture just the raw event.  
Thanks

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [January 11, 2022, 11:10am UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/2 "2022-01-11T11:10:38Z")

</div>

Reading further it looks like this is metdata being added by Logstash

---

<div class="post-metadata">

**Author:** ![FALEN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/falen/32/82754_2.png) [@FALEN](https://discuss.elastic.co/u/FALEN)\
**Post date:** [January 11, 2022, 11:33am UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/3 "2022-01-11T11:33:00Z")

</div>

can you share your logstash input&output

btw. You can remove fields by adding these to your logstash

> filter {  
> mutate { remove\_field =\> ["field1", "field2", "field3", ... "fieldN"] }  
> }

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [January 11, 2022, 11:44am UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/4 "2022-01-11T11:44:40Z")

</div>

Example:  
Syslog event looks like this prior to sending to logstash: \<13\>Jan 11 11:36:20 [server1.domain.net](http://server1.domain.net) {BLAHBLAHBLAH....

Using the following in logstash:

input {  
tcp  
{  
port =\>1001  
type=\> syslog  
}  
}

The output is this:  
2022-01-11T11:35:01.785Z [syslogserver.domain.net](http://syslogserver.domain.net) \<13\>Jan 11 11:36:20 [server1.domain.net](http://server1.domain.net) {BLAHBLAHBLAH....  
Is it possible to stop log stash adding 2022-01-11T11:35:01.785Z [syslogserver.domain.net](http://syslogserver.domain.net)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [January 11, 2022, 12:45pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/5 "2022-01-11T12:45:32Z")

</div>

Are you using the Kafka output? Please share your full pipeline.

If you want to send the raw event to the Kafka topics, you will need to have the following codec in your output.

```auto
codec => plain { format => "%{message}" }

```

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [January 11, 2022, 12:51pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/6 "2022-01-11T12:51:16Z")

</div>

> [@pruttle](#):
>
> input {  
> tcp  
> {  
> port =\>1001  
> type=\> syslog  
> }  
> }
> 
> The output is this:  
> 2022-01-11T11:35:01.785Z [syslogserver.domain.net](http://syslogserver.domain.net) \<13\>Jan 11 11:36:20 [server1.domain.net](http://server1.domain.net) {BLAHBLAHBLAH....  
> Is it possible to stop log stash adding 2022-01-11T11:35:01.785Z [syslogserver.domain.net](http://syslogserver.domain.net)

That was it. Thank you so much

---

<div class="post-metadata">

**Author:** ![pruttle](https://avatars.discourse-cdn.com/v4/letter/p/7ea924/32.png) [@pruttle](https://discuss.elastic.co/u/pruttle)\
**Post date:** [January 11, 2022, 1:35pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/7 "2022-01-11T13:35:57Z")

</div>

On a separate matter, what happens if you add\_field a value into a field that already has a value? Does it append the data or overwrite?

P.S. Will start new thread if required.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 11, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/8 "2022-01-11T14:23:17Z")

</div>

It becomes an array.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2022, 2:24pm UTC](https://discuss.elastic.co/t/logstash-input-adds-data-stamp-and-host/294021/9 "2022-02-08T14:24:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.