Can I delete the message field from Logstash?

Question

I have a basic Logstash -> Elasticsearch setup, and it turns out the 'message' field is not required after the logstash filter done its job - storing this raw message field to elasticsearch is only adding unnecessary data to storage imo.

Can I safely delete this field and would it cause any trouble to ES? advices or readings are welcome, thanks all.

Answer 1

No, it will not cause any trouble to ES. You can delete message field if it is redundant or unused.

You can add this filter to end of the filters.

mutate {      remove_field => [ "message" ] } 

Answer 2

You can also do this within the json filter.

filter {   json {     source => "message"     remove_field => ["message"]   } }