# Can I Delete the Message Field From Logstash?

Yes, you can delete the `message` field in Logstash if it’s no longer needed after processing. This can be useful for reducing data volume in Elasticsearch or removing redundant information. Here’s a quick guide on how to do it effectively.

### Steps to Delete the `message` Field

1. **Process and Extract Necessary Information**
    
    Before deleting `message`, ensure that you’ve extracted all needed information from it. For example, use filters like `grok`, `json`, or `kv` to parse relevant fields.
    
2. **Use the `mutate` Filter to Remove `message`**
    
    Once you’ve extracted the required fields, add a `mutate` filter to remove the `message` field:
    
    ```
    filter {
      # Parsing or extraction here (e.g., grok)
      mutate {
        remove_field => ["message"]
      }
    }
    
    ```
    
    This will delete `message` from each event, leaving only the parsed fields you’ve extracted.
    
3. **Conditional Deletion (Optional)**
    
    If you want to remove `message` only under certain conditions, you can wrap the `mutate` filter in a conditional statement:
    
    ```
    filter {
      if [some_field] == "some_value" {
        mutate {
          remove_field => ["message"]
        }
      }
    }
    
    ```
    

### Benefits and Caution

Deleting the `message` field can save storage space and make your data cleaner in Elasticsearch. However, be cautious—if you need to refer to the original log content later, removing `message` will make that impossible unless stored elsewhere. Consider testing this configuration in a staging environment first.