# Message.raw in logstash 2

**URL:** <https://discuss.elastic.co/t/message-raw-in-logstash-2/34659>\
**Category:** Logstash\
**Created:** [November 16, 2015, 9:39am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659 "2015-11-16T09:39:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jyotirtest](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jyotirtest](https://discuss.elastic.co/u/jyotirtest)\
**Post date:** [November 16, 2015, 9:39am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/1 "2015-11-16T09:39:23Z")

</div>

Hi,

We were using logstash 1.5 and recently upgraded to logstash 2. We are unable to get message.raw in elasticsearch.

We followed mentioned link to make it work on logstash 1.5

> <https://github.com/elastic/logstash/issues/2506>

But it is not working in logstash 2.0

Jyotir

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 16, 2015, 9:54am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/2 "2015-11-16T09:54:50Z")

</div>

The change described in that issue will work fine in Logstash 2.0 too. What did you do to modify the index template?

---

<div class="post-metadata">

**Author:** ![jyotirtest](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jyotirtest](https://discuss.elastic.co/u/jyotirtest)\
**Post date:** [November 16, 2015, 9:58am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/3 "2015-11-16T09:58:54Z")

</div>

PFA the code from logstash 2, elasticsearch-template.json file

```
{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
       "_all" : {"enabled" : true, "omit_norms" : true},
       "dynamic_templates" : [ {
         "message_field" : {
           "match" : "message",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true,
               "fields" : {
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
             }
           }
         }
       }, {
         "string_fields" : {
           "match" : "*",
           "match_mapping_type" : "string",
           "mapping" : {
             "type" : "string", "index" : "analyzed", "omit_norms" : true,
               "fields" : {
                 "raw" : {"type": "string", "index" : "not_analyzed", "ignore_above" : 256}
               }
           }
         }
       } ],
       "properties" : {
         "@version": { "type": "string", "index": "not_analyzed" },
         "geoip" : {
           "type" : "object",
             "dynamic": true,
             "properties" : {
               "location" : { "type" : "geo_point" }
             }
         }
       }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 16, 2015, 12:14pm UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/4 "2015-11-16T12:14:44Z")

</div>

Okay, but what, exactly, did you do with this file? And whatever you did, have you verified that the index template indeed was updated by your actions?

---

<div class="post-metadata">

**Author:** ![jyotirtest](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@jyotirtest](https://discuss.elastic.co/u/jyotirtest)\
**Post date:** [November 17, 2015, 4:09am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/5 "2015-11-17T04:09:57Z")

</div>

added the mentioned line as been prescribed in github

"raw" : {"type": "string", "index" : "not\_analyzed", "ignore\_above" : 256}

I checked in again, and I can see message.raw in the elasticsearch. Thanks for response.

Jyotir

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 17, 2015, 4:46am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/6 "2015-11-17T04:46:03Z")

</div>

Where did you add that line? To which file? Did you do anything with that file after modifying it?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:22am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659/7 "2017-07-06T05:22:38Z")

</div>