# \[Solved\] How to get raw log in logstash

**URL:** https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215
**Category:** Logstash
**Created:** [June 5, 2017, 3:34am UTC](https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215 "2017-06-05T03:34:08Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [June 5, 2017, 3:34am UTC](https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215/1 "2017-06-05T03:34:08Z")

</div>

Hi, i have this case.

I send log from filebeat -\> logstash. (5.4). Now i need to get raw log in field "message" only

```
{
  "_index": "fb-test-2017.20",
  "_type": "ssh",
  "_id": "AVwPYDgrVEOhQqT8cqhk",
  "_version": 1,
  "_score": null,
  "_source": {
    "geoip": {},
    "offset": 9164,
    "beatname": "fb-test",
    "input_type": "log",
    "source": "/var/log/secure",
    "message": "May 16 10:49:44 Nginx-LB-Inside-02 sudo: pam_unix(sudo-i:auth): authentication failure; logname=admin uid=1002 euid=0 tty=/dev/pts/0 ruser=admin rhost= user=admin",
    "type": "ssh",
    "tags": [],
    "@timestamp": "2017-05-16T03:49:46.320Z",
    "beattype": "ssh",
    "@version": "1",
    "beat": {
      "hostname": "Nginx-LB-Inside-02",
      "name": "Nginx-LB-Inside-02",
      "version": "5.4.0"
    }
  }
}

```

I want get data in "message" field and write it to file in OUTPUT.

> May 16 10:49:44 Nginx-LB-Inside-02 sudo: pam\_unix(sudo-i:auth): authentication failure; logname=admin uid=1002 euid=0 tty=/dev/pts/0 ruser=admin rhost= user=admin

Anyone have suggestion for me ?

Thanks so much.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 5, 2017, 4:00am UTC](https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215/2 "2017-06-05T04:00:14Z")

</div>

You have a file output and you want it to contain the current contents of the `message` field and nothing else? See the example in the file output documentation:

```nohighlight
output {
 file {
   path => ...
   codec => line { format => "custom format: %{message}"}
 }
}

```

---

<div class="post-metadata">

### Author: ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)
#### Post date: [June 5, 2017, 7:51am UTC](https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215/3 "2017-06-05T07:51:05Z")

</div>

Thanks for quick reply,  
That all i need. My problem is solved

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2017, 7:51am UTC](https://discuss.elastic.co/t/solved-how-to-get-raw-log-in-logstash/88215/4 "2017-07-03T07:51:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.