# Message field in logstash pipeline
**URL:** https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304
**Category:** Logstash
**Created:** [July 21, 2025, 12:47pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304 "2025-07-21T12:47:02Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@TheJ](https://discuss.elastic.co/u/TheJ)
#### Post date: [July 21, 2025, 12:47pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304/1 "2025-07-21T12:47:02Z")
Hi,
is this possible in logstash to change message match field to other name ?
I mean I have input and filter section in logstash pipeline as follow:
```auto
input {
udp {
host => "0.0.0.0"
port => 895
}
}
filter {
grok {
match => {'message' => ' {GREEDYDATA:message}'}
}
}
```
Can i change message to any other value like `event` or `raw_log` ? When i change this value to event i got `_grokparsefailure`
Thanks in advance.
---
### Author:  [@dot-mike](https://discuss.elastic.co/u/dot-mike)
#### Post date: [July 21, 2025, 4:21pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304/2 "2025-07-21T16:21:48Z")
Read on Logstash filter plugins:
> **[Filter plugins | Logstash Plugins](https://www.elastic.co/docs/reference/logstash/plugins/filter-plugins)**
>
> A filter plugin performs intermediary processing on an event. Filters are often applied conditionally depending on the characteristics of the event. For...
Most relevant for you is the mutate plugin: [Mutate filter plugin | Logstash Plugins](https://www.elastic.co/docs/reference/logstash/plugins/plugins-filters-mutate)
> The mutate filter allows you to perform general mutations on fields. You can rename, replace, and modify fields in your events.
Example
```auto
mutate {
rename => {"shortHostname" => "hostname"}
}
```
Note that the `message` field is usually a `text` field and you would have to add a new mapping setting your new custom field to `text` for it to be searchable like `mesage`
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [July 21, 2025, 5:43pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304/3 "2025-07-21T17:43:19Z")
Yes, you can do:
```auto
grok {
match => {'anyotherfield' => ' %{GREEDYDATA:message}'}
}
```
For instance, you can: `match => {'[event][original]' => ' %{GREEDYDATA:message}'}`
If you use _'message' =\> '...parsed fields... %{GREEDYDATA:message}'_ then you will get an array _[message][0]=old\_(orginal)\_data_ and _[message][1]=message\_from\_greedydata_. In that case, to avoid, you can use overwrite the message.
```auto
grok {
match => { "message" => "%{something} %{GREEDYDATA:message}" }
overwrite => ["message"]
}
```
As Mike said, you can of course use rename at any time.
In you have further questions, feel free to ask.
---
### Author:  [@TheJ](https://discuss.elastic.co/u/TheJ)
#### Post date: [July 22, 2025, 12:09pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304/4 "2025-07-22T12:09:35Z")
This solution work for me.
Thanks a lot