title: Logstash remove field after JSON-parsing it
body: <p>Using Logstash 1.4.2 with ElasticSearch 1.3 (I'm aware it's not the latest ES version available) on Ubuntu 14.04 LTS.</p>
  
  <p>We have an event stream which contains JSON inside one of its fields named "message".</p>
  
  <p>We'd like to replace the event fields by the JSON of that field if it's found.</p>
  
  <p>We'd also like to remove the ORIGINAL "message" field (the one which contains the JSON string) if found and parsed.</p>
  
  <p>The problem is that the JSON object inside the field's text could define a new "message" field, which we have to retain.</p>
  
  <p>The following removes the "message" field always after parsing it:</p>
  
  <pre><code>json {
    source =&gt; "message"
    remove_field =&gt; [ "message" ]
  }
  </code></pre>
  
  <p>Which is wrong, we want to keep it in case there was a "message" field inside the value of the original "message" field.</p>
  
  <p>I tried to do the following trick, but it seems to still remove the "message" field from the result:</p>
  
  <pre><code>mutate {
    rename =&gt; [ "message", "___temp_logstash_filter_message___" ]
  }
  json {
    source =&gt; "___temp_logstash_filter_message___"
  }
  mutate {
    remove_field =&gt; [ "___temp_logstash_filter_message___" ]
  }
  </code></pre>
  
  <p>i.e. I try to rename the original "message" field to an arbitrary internal name which I don't expect to appear in the input value, parse the JSON string using that temporary name as a source, then remove the renamed original field.</p>
  
  <p>That way I was hoping to distinguish between the "original" message field and any "message" field which may be contained inside its JSON value. But this doesn't seem to make a difference - the "message" field is still missing from the result.</p>
  
  <p>Is there a way to achieve what I need?</p>
  
  <p>Thanks.</p>