# Remove part of message string

**URL:** <https://discuss.elastic.co/t/remove-part-of-message-string/66809>\
**Category:** Logstash\
**Created:** [November 22, 2016, 3:48am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809 "2016-11-22T03:48:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 22, 2016, 3:48am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/1 "2016-11-22T03:48:23Z")

</div>

Hi there,

In the message field in kibana i am getting

> 2016-11-22 11:37:50,  
> 943 app INFO: error\_test - 82 test message  
> 2016-11-22 11:37:50,  
> 943 app ERROR: error\_test - 83 test error log

As I have a separate @timestamp field, I think it would be redundant for my messages to contain the timestamp string. To make my logs neater, I want to remove the timestamp from my message.  
I've tried using the drop filter, but I realized it's for fieldnames.  
Any idea what filter i should use or how i can remove the timestamp from my message?

thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 22, 2016, 6:30am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/2 "2016-11-22T06:30:29Z")

</div>

> I've tried using the drop filter, but I realized it's for fieldnames.

No, the drop filter drops whole events.

> Any idea what filter i should use or how i can remove the timestamp from my message?

Use a mutate filter's gsub option or a grok filter.

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 22, 2016, 8:10am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/3 "2016-11-22T08:10:01Z")

</div>

Thank you for your reply,

I will use the mutate gsub filter, I'm having some difficulty coming up with the filter.

```
filter {
  mutate {
    gsub => ["message", "...", ""]
  }
}

```

What should i put for the timestamp 2016-11-22 11:37:50,943

Thanks!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 22, 2016, 10:35am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/4 "2016-11-22T10:35:32Z")

</div>

This should work:

```
gsub => ["message", "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} ", ""]
```

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 23, 2016, 12:39am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/5 "2016-11-23T00:39:40Z")

</div>

Works!! Thank you!

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 23, 2016, 2:02am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/6 "2016-11-23T02:02:21Z")

</div>

Hi, I'm able to remove the timestring, but Im facing a new problem.  
Before using the above gsub filter, I was able to get the loglevels in my message(in my first post) into a field by using

```
mutate {
  split => { "message" => "," }
}

```

I'm able to get this

> loglevel: INFO, ERROR

But after using the gsub filter, I'm only getting loglevel: INFO.  
How can i solve this?

Thanks

---

<div class="post-metadata">

**Author:** ![Elias\_Lim](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Elias\_Lim](https://discuss.elastic.co/u/Elias_Lim)\
**Post date:** [November 23, 2016, 2:46am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/7 "2016-11-23T02:46:47Z")

</div>

Ignore my last post, I managed to fix it.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 21, 2016, 2:47am UTC](https://discuss.elastic.co/t/remove-part-of-message-string/66809/8 "2016-12-21T02:47:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.