# Rename the message field from the original log

**URL:** <https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674>\
**Category:** Logstash\
**Created:** [May 28, 2020, 7:03am UTC](https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674 "2020-05-28T07:03:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [May 28, 2020, 7:03am UTC](https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674/1 "2020-05-28T07:03:25Z")

</div>

I have a log line.

`1590644837.665697 2020-05-28 07:47:17,665 to:004915122898981|id:Hello there|status_code:SentSMSOK|status_message:abc.exmaple.com - 200|message:(2020-05-28 07:46:41) TEST: stuck-daily@example.com is OK (OK - Table:ETL_PROCESS_DAILY_LOADS HoursOld:6 CountResult:0 (10min cache))!`

This is my logstash config:

```auto
input {
  stdin { }
}
filter {
        grok {
            match => [
                "message" , "%{GREEDYDATA:data}"
                ]
        }
        date {
            match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
            remove_field => ["timestamp"]
        }

        if [data] {
           kv {
              source => "data"
              field_split => "|"
              value_split => ":"
           }
        }
}

output {
  stdout { codec => rubydebug }
}

```

Here is the output from logstash:

```
{
                                     "data" => "1590644837.665697 2020-05-28 07:47:17,665 to:004915122898981|id:Hello there|status_code:SentSMSOK|status_message:abc.exmaple.com - 200|message:(2020-05-28 07:46:41) TEST: stuck-daily@example.com is OK (OK - Table:ETL_PROCESS_DAILY_LOADS HoursOld:6 CountResult:0 (10min cache))!",
                                  "message" => "(2020-05-28 07:46:41) TEST: stuck-daily@example.com is OK (OK - Table:ETL_PROCESS_DAILY_LOADS HoursOld:6 CountResult:0 (10min cache))!",
                           "status_message" => "abc.exmaple.com - 200",
                               "@timestamp" => 2020-05-28T06:57:54.609Z,
                                 "@version" => "1",
                                     "host" => "def",
    "1590644837.665697 2020-05-28 07" => "47:17,665 to:004915122898981",
                                       "id" => "Hello there",
                              "status_code" => "SentSMSOK"
}

```

The message filed is being overwritten by the message field from the log file. How we can rename the message field from the log?

---

<div class="post-metadata">

**Author:** ![chitreshg](https://avatars.discourse-cdn.com/v4/letter/c/df705f/32.png) [@chitreshg](https://discuss.elastic.co/u/chitreshg)\
**Post date:** [May 28, 2020, 8:41am UTC](https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674/2 "2020-05-28T08:41:17Z")

</div>

> [@marco2005](#):
>
> 1590644837.665697 2020-05-28 07:47:17,665 to:004915122898981|id:Hello there|status\_code:SentSMSOK|status\_message:abc.exmaple.com - 200|message:(2020-05-28 07:46:41) TEST: [stuck-daily@example.com](mailto:stuck-daily@example.com) is OK (OK - Table:ETL\_PROCESS\_DAILY\_LOADS HoursOld:6 CountResult:0 (10min cache))!

if you want to rename the **message** from the log then use mutate-gsub filter in the beginning of filter plugin

```
mutate {
	gsub => ["message", "message:", "information:"]
}

```

above code will replace **message** field as **information** field.

and if you want to remove the message field from output then use mutate-rename filter

```
  mutate {
    rename => { "message" => "information" }
  }

```

---

<div class="post-metadata">

**Author:** ![marco2005](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@marco2005](https://discuss.elastic.co/u/marco2005)\
**Post date:** [May 29, 2020, 1:29pm UTC](https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674/3 "2020-05-29T13:29:34Z")

</div>

Thanks it works

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2020, 1:29pm UTC](https://discuss.elastic.co/t/rename-the-message-field-from-the-original-log/234674/4 "2020-06-26T13:29:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.