# Merge field message and msg
**URL:** https://discuss.elastic.co/t/merge-field-message-and-msg/232644
**Category:** Elasticsearch
**Created:** [May 14, 2020, 12:43pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644 "2020-05-14T12:43:17Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@raulgs](https://discuss.elastic.co/u/raulgs)
#### Post date: [May 14, 2020, 12:43pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644/1 "2020-05-14T12:43:17Z")
Hi guys,
I noticed today that for some pods log messages are available in the message field, while for others they in the msg field. Is there some way to merge this field or make them all available over a pointer that links merges the result of both of them?
---
### Author:  [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [May 14, 2020, 1:08pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644/2 "2020-05-14T13:08:32Z")
If you have Logstash in your pipeline you can do all kind of alteration to your logs, e.g.
```auto
filter {
if [msg] {
mutate {
rename => { "msg" => "message" }
}
}
}
```
See
[https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html)
---
### Author:  [@raulgs](https://discuss.elastic.co/u/raulgs)
#### Post date: [May 14, 2020, 2:34pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644/3 "2020-05-14T14:34:29Z")
I am using fluentd actually for log collection 🤔
---
### Author:  [@hunsw](https://discuss.elastic.co/u/hunsw)
#### Post date: [May 14, 2020, 2:37pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644/4 "2020-05-14T14:37:53Z")
I'm sure fluentd have similar functionality... OR you can switch to FluentBit, forward logs to a Logstash instance then to Elasticsearch. 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2020, 2:37pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644/5 "2020-06-11T14:37:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.