# Message contains full log line
**URL:** https://discuss.elastic.co/t/message-contains-full-log-line/146692
**Category:** Logstash
**Created:** [August 30, 2018, 11:37am UTC](https://discuss.elastic.co/t/message-contains-full-log-line/146692 "2018-08-30T11:37:07Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Ico\_Re](https://discuss.elastic.co/u/Ico_Re)
#### Post date: [August 30, 2018, 11:37am UTC](https://discuss.elastic.co/t/message-contains-full-log-line/146692/1 "2018-08-30T11:37:07Z")
Hi
I have the following filter defined in the logstash.conf
```
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} (?\[.*\])? %{LOGLEVEL:level} %{DATA:classname} %{GREEDYDATA:message}" }
}
}
```
And this works fine, it match the log I have (Java app). Now, when i go to Kibana, all fields defined here (timestamp, thread, level, classname) are shown correctly. The problem is message field. Basically it is shown the full line from the log, for example:
```
2018-08-30 12:34:58,591 [cluster-nio-worker-0] TRACE c.c.d.c.ClassName Some message here
```
I think this is because of the first part in match: `"message" => ...`
I also tried to change "message" to "msg" but then it doesn't work.
How can I have only the message (last part of the log)?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 30, 2018, 11:56am UTC](https://discuss.elastic.co/t/message-contains-full-log-line/146692/2 "2018-08-30T11:56:59Z")
Add `overwrite => ["message"]` in your grok filter.
---
### Author:  [@Ico\_Re](https://discuss.elastic.co/u/Ico_Re)
#### Post date: [August 31, 2018, 8:42am UTC](https://discuss.elastic.co/t/message-contains-full-log-line/146692/3 "2018-08-31T08:42:05Z")
Thanks. It works like a charm 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 28, 2018, 8:42am UTC](https://discuss.elastic.co/t/message-contains-full-log-line/146692/4 "2018-09-28T08:42:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.