# Message in json but not full
**URL:** https://discuss.elastic.co/t/message-in-json-but-not-full/194013
**Category:** Logstash
**Created:** [August 6, 2019, 12:53pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013 "2019-08-06T12:53:20Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Arnodl](https://discuss.elastic.co/u/Arnodl)
#### Post date: [August 6, 2019, 12:53pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013/1 "2019-08-06T12:53:20Z")
Hello, I have problem with parsing the message:
fun.host.pl: /storage/test / applications / central / logger\_data\_20190801: prm:
{
"@timestamp": "2019-08-01T10:24:07.32",
"appid": "prm",
"tags": ["SUCC:AUTHEN"],
"client": {
"ip": "127.0.0.1"
},
"host": {
"hostname": "fun.host.pl",
"type": "test"
},
"service": {
"name": "prm",
"session\_id": "12ab3",
"type": "access",
"subname": "login"
},
"user": {
"id": "userek"
}
}
this is json but by the beginning of the message: "fun.host.pl: /storage/test / applications / central / logger\_data\_20190801: prm:" my message is not being parsed and it looks like this:
{
"message": "iastest16.test.sun.orange.sk:/storage/test/applications/central/logger\_data\_20190801:prm:{ "@timestamp": "2019-08-01T09:10:52.47", "appid": "prm", "tags": ["SUCC:AUTHEN"], "client": { "ip": "10.8.253.166" }, "host": { "hostname": "iastest16.test.sun.orange.sk", "type": "test" }, "service": { "name": "prm", "session\_id": "201908010910524740a2223e-79bf-411c-8912-6664a3118493", "type": "access", "subname": "login" }, "user": { "id": "userek" } }\n\n",
"@version": "1",
"@timestamp": "2019-08-01T07:10:53.369Z"
}
how to remove the part of which is not json?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 6, 2019, 1:40pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013/2 "2019-08-06T13:40:57Z")
```
mutate { gsub => ["message", "\A[^{]+", "" ] }
```
---
### Author:  [@Arnodl](https://discuss.elastic.co/u/Arnodl)
#### Post date: [August 7, 2019, 12:51pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013/3 "2019-08-07T12:51:10Z")
it doesn't work on the website: [https://regexr.com/](https://regexr.com/)
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 7, 2019, 1:39pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013/4 "2019-08-07T13:39:25Z")
OK, but it works in logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 4, 2019, 1:39pm UTC](https://discuss.elastic.co/t/message-in-json-but-not-full/194013/5 "2019-09-04T13:39:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.