# Only specific output from logstash **URL:** \ **Category:** Logstash\ **Created:** [February 19, 2016, 1:46pm UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245 "2016-02-19T13:46:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 19, 2016, 1:46pm UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/1 "2016-02-19T13:46:35Z")
Is there a way I can send only certain parts of a log to elasticsearch. I don't want to remove some logs, I want to remove some parts of a log. For eg. I want to remove [INFO] from my log, and only send the rest of it to elasticsearch. Is there a way to do it? ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [February 19, 2016, 3:11pm UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/2 "2016-02-19T15:11:20Z")
I moved your question to Logstash. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 20, 2016, 5:08am UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/3 "2016-02-20T05:08:03Z")
Can you also help me with the solution? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 22, 2016, 6:16pm UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/4 "2016-02-22T18:16:54Z")
Normally one would use a grok filter to extract fields from a flat log message, and then you can simply skip extracting fields from the parts of the message that you don't care about. If that doesn't answer your question you have to be more specific. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 23, 2016, 6:01am UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/5 "2016-02-23T06:01:17Z")
I understand that I can index certain parts of the log message, But actually the entire log message gets stores in the \_source field. What is I don't want the unidexed parts to get staore in the \_source field? Do I have to then disable \_source and then enable store for each individual field? Or is there a better alternative? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [February 23, 2016, 6:28am UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/6 "2016-02-23T06:28:08Z")
You can indeed disable `_source` and save some space, or you can remove specific fields completely. What I don't think you can do is index the contents of field `A` without including `A` in the document saved in `_source`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245/7 "2017-07-06T05:10:10Z")