# Remove logstash default timestamp and host info

**URL:** <https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333>\
**Category:** Logstash\
**Created:** [June 11, 2018, 10:17am UTC](https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333 "2018-06-11T10:17:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![simple365](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@simple365](https://discuss.elastic.co/u/simple365)\
**Post date:** [June 11, 2018, 10:17am UTC](https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333/1 "2018-06-11T10:17:21Z")

</div>

Hi there:

My env info

```
Logstash 2.4.1
Kafka 2.10-0.8.2.1

```

My logstash config is

```
input {
	kafka {
	group_id => "salo"
	zk_connect=>"192.168.5.126:2181,192.168.5.21:2181,192.168.5.225:2181"
	topic_id=>"info_flow"
	}
}
filter {
	mutate {
	remove_field => ["%{timestamp}","%{host}"]
	}
}
output {
	s3{
 		bucket => "....."                    
 		size_file => 5242880
 		time_file => 4
 		prefix => "logs/info_flow/"
	}
}

```

My original kafka message is like

```
1528707594000|192.168.5.1|{"appkey":"Un7ey3h","d":{"et":[.....

```

But after logstash process , this turns to be

```
2018-06-11T08:37:38.728Z %{host} 1528707594000|192.168.5.1|{"appkey":"Un7ey3h","d":{"et":[.....

```

We don't want

- 2018-06-11T08:37:38.728Z
- %{host}

at all. Could you help to figure out how to delete them ? Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2018, 2:00pm UTC](https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333/2 "2018-06-11T14:00:42Z")

</div>

> [@simple365](#):
>
> Could you help to figure out how to delete them ?

I think these are being added by the output codec. Can you try adding this to your s3 output:

```
codec => line { format => "%{message}" }

```

---

<div class="post-metadata">

**Author:** ![simple365](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@simple365](https://discuss.elastic.co/u/simple365)\
**Post date:** [June 12, 2018, 1:42am UTC](https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333/4 "2018-06-12T01:42:14Z")

</div>

Yes, exactly! Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2018, 1:42am UTC](https://discuss.elastic.co/t/remove-logstash-default-timestamp-and-host-info/135333/5 "2018-07-10T01:42:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.