# Saving just the "message" to file using http input and file output plugins

**URL:** https://discuss.elastic.co/t/saving-just-the-message-to-file-using-http-input-and-file-output-plugins/376340
**Category:** Logstash
**Created:** [March 24, 2025, 4:28pm UTC](https://discuss.elastic.co/t/saving-just-the-message-to-file-using-http-input-and-file-output-plugins/376340 "2025-03-24T16:28:46Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 24, 2025, 5:19pm UTC](https://discuss.elastic.co/t/saving-just-the-message-to-file-using-http-input-and-file-output-plugins/376340/2 "2025-03-24T17:19:11Z")

</div>

An [@timestamp] field is automatically added when an event is created. If you do not want it then modify your mutate to remove it

```
mutate { remove_field => ["headers", "host", "message", "@version", "@timestamp"] }

```

If you think about the ruby code, it splits the http response into an array of four lines, then it calls event.clone for each line. So you end up with the original event and four clones of it, so five lines in the output.

If you look at the [post](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567/26) where you copied that code from you will see there is a call to event.cancel which deletes the original event if there are no problems. You could remove the if-else that surrounds it, but do not remove the call itself.

---

_[View the full topic](https://discuss.elastic.co/t/saving-just-the-message-to-file-using-http-input-and-file-output-plugins/376340)._