# Remove timestamp and host frpm logfile

**URL:** <https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480>\
**Category:** Logstash\
**Created:** [October 14, 2019, 3:00pm UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480 "2019-10-14T15:00:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hdma](https://avatars.discourse-cdn.com/v4/letter/h/ebca7d/32.png) [@hdma](https://discuss.elastic.co/u/hdma)\
**Post date:** [October 14, 2019, 3:00pm UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480/1 "2019-10-14T15:00:04Z")

</div>

Hello  
I have a logstash that receive log from other logstash using tcp:  
input {  
tcp {  
port =\> 65009  
mode =\> server  
id =\> "wm-id"  
tags =\> "wm"  
codec =\> line  
}  
}

In output, I put this syslog into file:  
filter {  
ruby {  
code =\> '  
if File.readlines("/proc/mounts").any?{ |line| line.split(" ")[0] == "/dev/drbd0" }  
#logger.info("drbd is mounted.");  
else  
logger.info("drbd is not mounted. I drop every event");  
event.cancel;  
end  
'  
}

```
    ruby {
            code => "event.set('index_day', event.get('[@timestamp]').time.localtime.strftime('%Y%m%d%H'))"
    }

    grok {
           match => ["message", "%{SYSLOGTIMESTAMP:date} %{IPORHOST:hostname} %{GREEDYDATA:message}"]
           overwrite => ["message"]
    }

```

}

output {  
if "wm" in [tags] {  
file {  
#questo server per avere nel file solo log vero e proprio  
codec =\> line {  
format =\> "%{message}"  
}  
path =\> "/drbd/web-logs/wm-%{index\_day}.log"  
}  
}  
}

I tried with different filter to remove, before to write into file, timestamp and source ip.  
The genuine log is:  
xxx.xxx.62.231 1571064805.792 4766 xxx.xxx.35.86 64375 0 TUNNELED 5593 2406 unknown ssl ssl://kkkkk-t.kkkkk.tv:443/ kkkk [k-t.kkkkk.tv](http://k-t.kkkkk.tv) - - OBSERVED Web%20Ads/Analytics -

write into log file is:  
2019-10-14T14:53:26.127Z [vlan22.tt-hhhhh.foo.com](http://vlan22.tt-hhhhh.foo.com) xxx.xxx.62.231 1571064805.792 4766 xxx.xxx.35.86 64375 0 TUNNELED 5593 24 06 unknown ssl ssl://kkkkk-t.kkkkk.tv:443/ [kkkkk-t.kkkkk.tv](http://kkkkk-t.kkkkk.tv) - - OBSERVED Web%20Ads/Analytics -

I want to remove "2019-10-14T14:53:26.127Z" and "[vlan22.tt-hhhhh.foo.com](http://vlan22.tt-hhhhh.foo.com)".  
Please can I help me?

Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 14, 2019, 4:26pm UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480/2 "2019-10-14T16:26:24Z")

</div>

I would expect a line codec to add a timestamp and hostname if you do not specify the format option. With format =\> "%{message}" it should just write out the contents of the [message] field.

---

<div class="post-metadata">

**Author:** ![hdma](https://avatars.discourse-cdn.com/v4/letter/h/ebca7d/32.png) [@hdma](https://discuss.elastic.co/u/hdma)\
**Post date:** [October 15, 2019, 8:53am UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480/3 "2019-10-15T08:53:43Z")

</div>

Hi Badger your tip help me to resolve the problem.  
Below the filter:  
filter {  
ruby {  
code =\> '  
if File.readlines("/proc/mounts").any?{ |line| line.split(" ")[0] == "/dev/drbd0" }  
#logger.info("drbd is mounted.");  
else  
logger.info("drbd is not mounted. I drop every event");  
event.cancel;  
end  
'  
}

```
    ruby {
            code => "event.set('index_day', event.get('[@timestamp]').time.localtime.strftime('%Y%m%d%H'))"
    }

    grok {
           match => ["message", "%{TIMESTAMP_ISO8601:timestamp} %{IPORHOST:hostname} %{GREEDYDATA:message}"]
           overwrite => ["message"]
    }

```

}

The problem is that I haven't found documentation about the mean of TIMESTAMP\_ISO8601, IPORHOST and GREENDYDATA.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [October 15, 2019, 2:25pm UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480/4 "2019-10-15T14:25:42Z")

</div>

> [@hdma](#):
>
> The problem is that I haven't found documentation about the mean of TIMESTAMP\_ISO8601, IPORHOST and GREENDYDATA.

Those are all defined in the basic grok [patterns](https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/grok-patterns).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2019, 2:26pm UTC](https://discuss.elastic.co/t/remove-timestamp-and-host-frpm-logfile/203480/5 "2019-11-12T14:26:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.