# Make Readable message in kibana

**URL:** <https://discuss.elastic.co/t/make-readable-message-in-kibana/251428>\
**Category:** Logstash\
**Created:** [October 8, 2020, 11:17am UTC](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428 "2020-10-08T11:17:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [October 8, 2020, 11:17am UTC](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428/1 "2020-10-08T11:17:48Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a6712bcf4ec0902d63763ecb88a3db388caad5c2.png)

In the above picture you can see message,timestamp and fields which is added by grok pattern.  
with use grok pattern take value from message and added into fields(set names in grok).  
now in fields you can see values but in the message the values also here and it doesn't make any sense .  
I want see in message field only message of log.

for more detail here is my grok pattern :

```
filter{
        if [fields][log_type] == "gbase"
	    {
	         if [level] in ["Error", "Fatal"] 
	         {
			     grok { match=> ["message","%{DATESTAMP:timestamp} %{WORD:processId} %{LOGLEVEL:level} %{USERNAME:logger} %{USER:user} %{URI:requestUrl} %{USER:method} %{IPV4:clientIp} %{GREEDYDATA:message}"]}
	         }
		     else
		     {
			      grok { match=> ["message","%{DATESTAMP:timestamp} %{WORD:processId} %{LOGLEVEL:level} %{USERNAME:logger} %{USER:user} %{IPV4:clientIp} %{GREEDYDATA:message}"]}
		     }
		
	   }
}   

```

How can I make this ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 5, 2020, 11:17am UTC](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428/2 "2020-11-05T11:17:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.